CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Windows ML CLI: CORS misconfig enables localhost RCE

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

`nx graph` dev server permissive CORS policy

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

qui CORS Misconfiguration: Arbitrary Origins Trusted

Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint