CORS Misconfiguration.

An insecure CORS policy that allows untrusted origins to read authenticated responses, often by reflecting the Origin header and returning Access-Control-Allow-Credentials: true. It belongs to the Attacks & Threats category of cybersecurity.

An insecure CORS policy that allows untrusted origins to read authenticated responses, often by reflecting the Origin header and returning Access-Control-Allow-Credentials: true.

CORS misconfiguration occurs when a server implements Cross-Origin Resource Sharing in a way that effectively disables the same-origin policy. Common mistakes include reflecting any Origin in Access-Control-Allow-Origin, allowing 'null' origins, whitelisting wildcard subdomains, or combining Allow-Origin: * with Allow-Credentials: true (rejected by browsers but often misimplemented). An attacker hosts a page that issues authenticated cross-origin requests; because the response is now readable, sensitive data such as session tokens, account details, or API responses can be exfiltrated. Defenses include strict origin allow-lists, rejecting Origin reflection, and never combining credentials with broad wildcards.

Defences for CORS Misconfiguration typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Permissive CORS.