Executive brief
TypeSpec Spector is a mock API server tool used by developers for testing. An attacker on the network can send a single HTTP POST request to shut down the server without any authentication, causing the service to crash and become unavailable. This is particularly dangerous because the server listens on all network interfaces by default, making it reachable from untrusted network segments like shared CI/CD runners or cloud environments.
Technical details
The vulnerability is a Missing Authentication for Critical Function (CWE-306) in the POST /.admin/stop endpoint registered in packages/spector/src/routes/admin.ts. The endpoint lacks any authentication middleware, token validation, origin checks, or IP-source restrictions. An unauthenticated remote attacker with network access to the server port can send a POST request to terminate the process via process.exit(0). No preconditions exist beyond network reachability; the server binds to 0.0.0.0 by default with no CLI option to restrict binding, and the endpoint is registered before scenario routes, making it always reachable. The impact is complete denial of service with a single HTTP request. Patched in version 0.1.0-alpha.27.
Affected products
- Microsoft TypeSpec Spector <=0.1.0-alpha.26
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patched in version 0.1.0-alpha.27