Auth ⚑ High severity

CORS Misconfiguration — Wildcard with Credentials

Dynamic Origin reflection with Credentials: true allows any site to read authenticated user data.

📖 What is this?

Browsers block `Access-Control-Allow-Origin: *` combined with `Access-Control-Allow-Credentials: true`. But developers "fix" this by reflecting the `Origin` header dynamically — any domain becomes allowed, and since credentials (cookies, HTTP auth) are allowed, any site can read your users’ data. This is worse than the wildcard it was trying to avoid.

🔴 Vulnerable Code

❌ Vulnerable

// VULNERABLE — dynamic origin reflection
app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
  res.setHeader('Access-Control-Allow-Credentials', 'true');
  next();
});
// Any attacker-controlled site can now read authenticated user data

🟢 Fixed Code

✓ Fixed

// FIXED — explicit allowlist
const ALLOWED_ORIGINS = ['https://app.pulllight.io', 'https://pulllight.io'];
app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (ALLOWED_ORIGINS.includes(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Credentials', 'true');
  }
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
  next();
});

⚡ Real-World Incident

🔗

CVE / Real Incident

CVE-2026-32610 (Glances REST API CORS misconfiguration)

CVE-2026-32610 (Glances REST API CORS misconfiguration allowing data theft via wildcard origins + credentials). CWE-942 (Permissive Cross-domain Policy). Express.js documentation explicitly warns against dynamic origin reflection.

🔍 How PullLight Catches It

PullLight flags `Access-Control-Allow-Credentials: true` combined with wildcard origins or dynamic `req.headers.origin` reflection. It detects `Access-Control-Allow-Origin: *` with any credentials header and flags null-origin trust patterns (`if origin == ‘null’`).

See it in action — paste a diff into /analyze

Try a vulnerable example: pool.query(`SELECT * FROM users WHERE id = ${req.params.id}`)

Analyze a diff →

🔗 Related Patterns

📚 More Patterns