Catalog/VULNERABILITY/cors-misconfig
SCAN-ID: CORS-MISCONFIGREVISION 2026.4
VULNERABILITYCVSS 8.1 (HIGH)

CORS Misconfiguration Scanner

Detect dangerous CORS policies that allow unauthorized third-party origins to invoke authenticated APIs.

Technical Scope & Verification Behavior

Checks for Access-Control-Allow-Origin wildcard (*) with credentials allowed, dynamic reflection of arbitrary origin headers, and null origin bypasses.

Automated Inspection Checks (8)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

Origin: https://evil.attacker.com (returns ACAO: https://evil.attacker.com)

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Whitelisted CORS Configuration

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');
+++ b/handler.typescript (Remediated)
const ALLOWED = ['https://app.example.com'];
if (ALLOWED.includes(req.headers.origin)) {
  res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
}

Enforce strict origin whitelisting rather than reflecting caller headers or allowing wildcards on authenticated endpoints.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Refactor CORS middleware to validate the Origin header against a strict trusted domain whitelist before setting Access-Control-Allow-Origin."

Run Isolated Check

Test your public domain specifically for CORS Misconfiguration Scanner.

100% passive • No server load

Specification Details

CVSS Score
8.1 / 10.0
Severity Level
HIGH
Category
VULNERABILITY
Test Vectors
8 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#CORS#Headers#Origin#CWE-942

Run continuous monitoring for CORS Misconfiguration Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog