[standoff365.com] Session hijacking via Image in the Markdown

Recently developers have added a functionality that allows to insert and render images in the Markdown editors. From the first view the application loads and renders images only from https://api.standoff365.com host. But flaw in regular expression which checks image source host allows attacker to load images from any host that starts with https://api.standoff365.com substring.

 
Potential root cause in the https://standoff365.com/_next/static/chunks/pages/_app-77b486731aecfff6.js file:

 [...]
 if (d = t.properties.src, u !== Hc.NotFound && !new RegExp('^'.concat((0, p.VY) (), '.+')).test(d)) {
 	e.next = 14;
 	break
 }
 [...]

 
What makes this vulnerability serious is the fact that the application build HTTP request for image loading by itself and adds Authorization header with session token value. Such behavior leads to session token leakage to attacker's host: