CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
A kind of CWE-863 Incorrect Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- honojs honoHono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard7.1 High
- aqara developer portal, developer test portal +1 moreAqara Developer Portal cross-origin resource sharing8.2 High
- aqara iam/sso gateway, iam\/sso gateway +1 moreAqara IAM/SSO Gateway cross-origin resource sharing8.2 High
- network optix nx witness vmsCORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request7.5 High
- rustfsRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console6.0 Medium
- google mcp toolbox for databasesMCP Toolbox for Databases vulnerable to DNS rebinding attacks9.4 Critical
- flowiseFlowise - Hardcoded CORS Wildcard in TTS Endpoint6.9 Medium
- xyproto algernonAlgernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *4.3 Medium
github.com/xyproto/algernonGoAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication5.3 Medium- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreSame-origin policy bypass in the DOM: Networking component9.1 Critical
- kumahq kumaKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin5.1 Medium
- kong inc. meshKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin5.1 Medium
- google chromeInappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778...4.3 Medium
- google chromeInsufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168...4.3 Medium
- cleanuparrCleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads8.0 High
- yoda-digital mcp-gitlab-serverGitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab tools9.2 Critical
- chatgptnextweb nextchatChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy5.3 Medium
- alexta69 metubealexta69 MeTube CORS Policy main.py on_prepare cross-domain policy5.3 Medium
engramxnpmengram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection8.6 High- nicolargo glancesGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS7.7 High
- ericc-ch copilot-apiericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy6.9 Medium
- wwbn avideoAVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover8.1 High
- farion1231 cc-switchfarion1231 cc-switch ProxyServer server.rs cross-domain policy5.3 Medium
praisonaiagentsPyPIPraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint8.1 High- coolercontrol coolercontroldPermissive Cross-domain Policy with Untrusted Domains in coolercontrold6.3 Medium
- vanna-ai vannavanna-ai vanna FastAPI/Flask Server cross-domain policy5.3 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins7.1 High
- b3log siyuanSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection9.7 Critical
- bishopfox sliverSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface5.9 Medium
- nhost cli, nhost +1 moreNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port7.7 High
- powerdns dnsdistInformation disclosure via CORS misconfiguration3.1 Low
- lfprojects mcp java sdk, modelcontextprotocol java-sdk +1 moreMCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)6.1 Medium
- nicolargo glancesGlances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard7.1 High
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability2.6 Low
- autobrr quiqui CORS Misconfiguration: Arbitrary Origins Trusted9.0 Critical
- wwbn avideoAVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS8.1 High
- nicolargo glancesGlances's Default CORS Configuration Allows Cross-Origin Credential Theft8.1 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Permissable CORS policy7.1 High
- @tinacms cli, ssw tinacms\/cli +1 moreCross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS9.7 Critical
- doobidoo mcp-memory-servicemcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft8.1 High
- karnop realtime-collaboration-platformCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure7.4 High
- tp-link omada, tp-link systems inc. omada cloud controller, tp-link aginet +12 more +14 morePermissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers2.0 Low
- litestarLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins7.4 High
- shenzhen tenda technology co., ltd. w30e v2, tenda w30e firmware +1 moreTenda W30E V2 Permissive CORS Allows Cross-origin Data Access7.1 High
- altium 365Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access9.0 Critical
- erambaA CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker...6.5 Medium
- anoma opencodeOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution8.8 High
- drupal next.jsNext.js - Critical - Access bypass - SA-CONTRIB-2025-1226.1 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DOM: Workers component8.1 High
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DOM: Notifications component8.1 High
- Show moreLoading…