CORS Misconfiguration
High · Access Control · CWE-942
Description
Over-permissive Access-Control-Allow-Origin with credentials.
Root cause
Reflecting Origin without allow-list.
Impact
Cross-origin data theft.
Detection
CORS header review.
Mitigation
Strict origin allow-list; never * with credentials.
Secure coding
Server-side origin checks.
Safe lab example
PortSwigger CORS
Practise related skills in Labs or deepen on Academy library.