H3-2026-0070¶

Permissive Cross-Origin Resource Sharing (CORS) Configuration

Description¶

A web application returned Cross-Origin Resource Sharing headers that are overly permissive: an Access-Control-Allow-Origin of * combined with Access-Control-Allow-Credentials: true, or an Access-Control-Allow-Origin of null.

Impact¶

A permissive CORS policy can allow untrusted web origins to read authenticated responses from the application in a victim's browser, potentially exposing sensitive data. Whether this is exploitable depends on which endpoints return the headers, and what data they serve.

References¶

• OWASP: CORS OriginHeaderScrutiny
• CWE-942: Permissive Cross-domain Policy with Untrusted Domains