DNS Rebinding Vulnerability in Ericc-ch Copilot-API up to Version 0.7.0
CVE-2026-6874

5.3MEDIUM

Key Information:

Vendor

Ericc-ch

Status
Copilot-api
Vendor
CVE Published:
22 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6874?

A vulnerability exists in the Ericc-ch Copilot-API up to version 0.7.0, which affects the Header Handler component in the /token file. This issue allows an attacker to manipulate the Host argument, which may result in unintended reliance on reverse DNS resolution. Such an exploit can be executed remotely, posing a significant risk to the application's security. The exploit has been publicly disclosed, and the vendor was alerted to the issue but did not provide a response.

Affected Version(s)

copilot-api 0.1

copilot-api 0.2

copilot-api 0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6874 - Proof of Concept

References

https://vuldb.com/vuln/359039
vdb-entrytechnical-description
https://vuldb.com/vuln/359039/cti
signaturepermissions-required
https://vuldb.com/submit/795212
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu_Bao (VulDB User)
VulDB CNA Team
.