CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.
Schwachstellenklasse
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.
Quellen
- https://github.com/rybbit-io/rybbit
- https://github.com/rybbit-io/rybbit/blob/v2.6.0/server/src/index.ts
- https://github.com/rybbit-io/rybbit/commit/6f1039bdd3328a84d6700031bc0ce4714020e2f9
- https://github.com/rybbit-io/rybbit/issues/1038
- https://www.vulncheck.com/advisories/rybbit-reflects-any-origin-in-cors-responses-while-allowing-credentials
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.