-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typed-rest-client | npm | < 1.8.0 | 1.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the prepareRequest methods in credential handlers not validating request origin before setting Authorization headers. The commit diff shows all three handlers were modified to add origin tracking and conditional header injection. Pre-patch versions lacked the 'origin === options.host' check and 'allowCrossOriginAuthentication' guard, making them automatically forward credentials to any host during redirects. The added unit tests confirm the vulnerability by verifying Authorization headers are suppressed after redirects.