THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-7q9c-hpx7-9cwm (high) — TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

[GHSA] GHSA-7q9c-hpx7-9cwm (high) — TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

highgithub_advisoriesPublished 2026-09-04

GHSA-7q9c-hpx7-9cwm Severity: high CVE: None

TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

### Summary

`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

http://{host}:{port}/.admin/stopurl
logger.infodomain

Original source: https://github.com/advisories/GHSA-7q9c-hpx7-9cwm