CWE-942.

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

• CWE-346
• CWE-942

>=2.52.1, <2.52.3 · fixed in 2.52.3

MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

• gojue moling
• Authentication bypass
• CWE-942

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

• CWE-942

<0.32.0 · fixed in 0.32.0

Push Endpoint Returns Permissive CORS Headers

• vaadin
• vaadin flow
• CWE-346
• CWE-942

Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

• transmission
• CWE-942

Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

• Google Agent Development Kit (ADK) for Java
• Authentication bypass
• CWE-942

IBM Concert Software Permissive Cross-domain Security Policy

• IBM Concert
• CWE-942

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

• CWE-346
• CWE-942

>=0.0.1, <0.4.5 · fixed in 0.4.5

Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

• Apache Software Foundation Apache Camel
• CWE-942

Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection

• Apache Software Foundation Apache Camel
• CWE-942

Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

• Erudika scoold
• CWE-346
• CWE-942

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

• CWE-942

>=2.2.0, <=2.6.0 · no fixed version yet

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7

HCL Software iControl: iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy…

• HCL Software iControl
• CWE-942

RabbitMQ: CORS * reflects Origin with Allow-Credentials

• rabbitmq-server
• CWE-942

Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

• Eclipse Foundation open-vsx.org
• CWE-942

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• CWE-942

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

• Red Hat
• Red Hat Build of Apache Camel 3.33.4.redhat
• CWE-346
• CWE-942

ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

• ag-ui
• CWE-346
• CWE-942

Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

• Apache Software Foundation Apache Storm Webapp
• CWE-346
• CWE-942

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

• Authentication bypass
• Cross-site request forgery (CSRF)

<9.7.0 · fixed in 9.7.0

Windows ML CLI: CORS misconfig enables localhost RCE

• Authentication bypass
• CWE-942

<0.4.0 · fixed in 0.4.0

Azure Arc SQL Server Extension Elevation of Privilege Vulnerability

• Microsoft Azure Arc SQL Server Extension
• SQL injection
• Authentication bypass

ASUS Armoury Crate: A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows…

• ASUS Armoury Crate
• CWE-942

HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

• heyform
• CWE-942

Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

• rybbit
• CWE-942

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.

• CWE-942

Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

• getgrav grav-plugin-api
• CWE-942

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

• CWE-942

<4.5.6 · fixed in 4.5.6

OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

• openyak
• Code injection
• Authentication bypass

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

• CWE-942

<39.8.10 || >=40.0.0-alpha.1, <40.9.3 || >=41.0.0-alpha.1, <41.4.0 || >=42.0.0-alpha.1, <42.0.0 · fixed in 39.8.10, 40.9.3, 41.4.0, 42.0.0

`nx graph` dev server permissive CORS policy

• CWE-749
• CWE-942

>=17.0.4, <22.7.2 || >=23.0.0-beta.0, <23.0.0-beta.2 · fixed in 22.7.2, 23.0.0-beta.2

Missing authentication and permissive CORS policy

• ANDRITZ HIPASE-250
• ANDRITZ 250 SCALA
• Authentication bypass
• CWE-942

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

• jan
• CWE-183
• CWE-942

Improper CORS handling in MOVEit Transfer

• Progress MOVEit Transfer
• CWE-942

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

• CWE-942

<1.5.4 · fixed in 1.5.4

CORS Misconfiguration in DevOps Loop

• HCLSoftware DevOps Loop
• CWE-942

HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5…

• HCLSoftware Aftermarket EPC
• CWE-942

Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin

• grav
• CWE-942

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

• CWE-346
• CWE-942

<1.17.0 · fixed in 1.17.0

ASUS GameSDK: Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a…

• ASUS GameSDK
• CWE-942

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

• ruvnet ruflo
• Command injection
• Authentication bypass

HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

• HCLSoftware HCL DevOps Deploy
• CWE-942

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

• Authentication bypass
• Cross-site request forgery (CSRF)

<0.0.0-20260601151442-5c0ca35db828 · fixed in 0.0.0-20260601151442-5c0ca35db828

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that…

• Ubiquiti Inc UniFi OS Server
• Ubiquiti Inc Dream Machines
• CWE-942

IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

• UCD - IBM DevOps Deploy
• CWE-942

Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint

• papermark
• CWE-942

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

• CWE-183
• CWE-942

<4.5.5 · fixed in 4.5.5

PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

• PraisonAI
• CWE-942

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

• CWE-942

<4.12.25 · fixed in 4.12.25

Aqara Developer Portal cross-origin resource sharing

• Aqara Developer Portal
• Aqara Developer Test Portal
• CWE-942

Aqara IAM/SSO Gateway cross-origin resource sharing

• Aqara IAM/SSO Gateway
• CWE-942

CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request

• Network Optix Nx Witness VMS
• CWE-942

RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console

• rustfs
• Authentication bypass
• CWE-346

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

• CWE-942

<1.2.0 · fixed in 1.2.0

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

• CWE-346
• CWE-942

<3.1.2 · fixed in 3.1.2

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

• CWE-942

<1.17.7 · fixed in 1.17.7

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

• Information disclosure
• Authentication bypass

<1.17.7 · fixed in 1.17.7

Same-origin policy bypass in the DOM: Networking component

• Mozilla Firefox
• Mozilla Thunderbird
• Cross-site scripting (XSS)
• CWE-942

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

• CWE-346
• CWE-942

<2.7.25 || >=2.9.0, <2.9.15 || >=2.11.0, <2.11.13 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.5 · fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5