Cross-origin resource sharing: arbitrary origin trusted
Summary: PortSwigger Research describes a CORS misconfiguration in which a site trusts arbitrary origins, effectively disabling the same-origin policy and allowing two-way interaction by third-party websites. When the site also sends Access-Control-Allow-Credentials: true, third-party sites may carry out privileged actions and retrieve sensitive information; even without it, attackers may bypass IP-based access controls by proxying through users' browsers.
What's compelling: If your application reflects arbitrary origins alongside Access-Control-Allow-Credentials: true, any third-party site a logged-in user visits can act with that user's privileges and read what comes back. The recommended fix is a whitelist of trusted domains rather than a wildcard or programmatic origin checks.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026