Claude Code Router Cross-Origin Resource Sharing Misconfiguration Vulnerability

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability has been identified in Claude Code Router versions prior to 1.0.34. This vulnerability exposes user API keys or equivalent credentials to untrusted domains. Attackers could exploit this issue to steal credentials, misuse accounts, deplete quotas, or access sensitive information.

Impact

Exploitation of this vulnerability could lead to the exposure of user API keys or equivalent credentials, allowing attackers to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.

Remediation

Users can upgrade to Claude Code Router version 1.0.34 or later to address this vulnerability.