Exploiting CORS misconfigurations for Bitcoins and bounties

Summary: PortSwigger researcher James Kettle documented how servers that dynamically generate the Access-Control-Allow-Origin header from user-supplied Origin values can be exploited, including a bitcoin exchange where he retrieved a user's private API key and could disable notifications, enable 2FA to lock the user out, and transfer bitcoins to an arbitrary address. He also found exchanges that trusted origins merely ending in or starting with their domain, sites that whitelisted the 'null' origin reachable via a sandboxed iframe, and a Safari URL-parsing quirk reported by Bitwis3 that let whitelisted hostnames be spoofed.
Bottom line: The bitcoin exchange patched the flaw within 20 minutes of his report, but the same misconfiguration class - reflecting origins, trusting null, or matching on string prefixes and suffixes - was common enough that Kettle found it across multiple bug bounty programs whose hunters had already missed it.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026