#vulns.co
/
mcp by GKData.io

← Back to Gadgets

CORS reflection

Access-Control-Allow-Origin echoing the request Origin, especially with Access-Control-Allow-Credentials: true. That is a read gadget against the victim's session from any attacker page.

Tags: cors, ato, api

Typical severity: P3-P5

What it becomes

Worthless with ACAO: * and no credentials. Dangerous when ACAO reflects Origin AND ACAC: true on an authenticated API.

Where to look

  • API gateways
  • old REST
  • error handlers
  • null Origin from sandboxed iframes
  • regex allowlists that miss the dot

Chains

  • Account takeover / data read — Attacker page on evil.com fetches https://api.target.com/me with credentials:include and reads the body.
  • CSRF+ — If ACAO reflects and methods include PUT/DELETE, it is CSRF with a response body, not just a fire-and-forget POST.

Notes

  • ACAO: * cannot be combined with credentials in spec-compliant browsers. That combo is a misconfig but not an exploit in Chrome.
  • Test the error path: 401/500 handlers often reflect Origin when the happy path does not.

← Back to Gadgets