Executive brief
TypeSpec Spector is a mock API server used by developers and CI/CD pipelines to test API specifications. The server exposes an administrative shutdown endpoint that can be triggered by any network client without authentication or authorization checks. An attacker on the network can send a single HTTP request to terminate the server, causing complete unavailability and disrupting development, testing, or continuous integration workflows.
Technical details
This is a missing authentication vulnerability (CWE-306) in the Express.js-based Spector mock server. The vulnerability exists in packages/spector/src/routes/admin.ts, where the POST /.admin/stop endpoint is registered without any authentication middleware, token validation, Authorization header checks, Origin restrictions, or IP allowlists. The route handler directly calls process.exit(0) after responding with HTTP 202. The server listens on 0.0.0.0:3000 by default with no CLI option to restrict the binding address, making the endpoint network-reachable from any host with access to the port. An attacker needs only network reachability—no credentials, special headers, or user interaction are required. Exploitation is trivial: a single curl command or HTTP POST request terminates the process. The vulnerability was patched in version 0.1.0-alpha.27.
Affected products
- Microsoft TypeSpec <= 0.1.0-alpha.26
Timeline
- 2026-07-27: disclosed: Vulnerability disclosed on GitHub Advisory Database
- 2026-09-04: patched: Patched in version 0.1.0-alpha.27 (published 2026-09-04)