Cross-origin resource sharing: all subdomains trusted
Summary: PortSwigger Research describes a CORS misconfiguration in which an application's policy allows two-way interaction from all subdomains rather than a whitelist of trusted ones. The write-up notes this significantly increases attack surface, since an XSS vulnerability in any subdomain could compromise the application publishing the policy, and that some consumer ISPs return custom content for unregistered subdomains, which can introduce XSS even when an organization's own applications are secure.
What you should know: Trusting every subdomain means the weakest one - including a page an ISP injects onto an unregistered name - becomes a path into the application that set the policy.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026