connect-xcors CVE-2026-18825

Exploitation requires: (1) a target application using the connect-cors/connect-xcors middleware to enforce origin-based access control; (2) a victim who is already authenticated (has an active credentialed session) to that application; and (3) passive user interaction (UI:P) - the victim must visit or load attacker-controlled web content that triggers the cross-origin request. Impact is limited to Low confidentiality and Low integrity (no availability impact), and success depends on the browser sending credentials cross-origin, so the practical blast radius is bounded to whatever the vulnerable app exposes to authenticated CORS requests. No special server configuration is stated beyond use of the vulnerable middleware for origin checks.

Low-to-moderate real-world risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) scores 5.3, reflecting a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) and yields only Low confidentiality/integrity impact. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data provided. Signals are internally consistent (a CORS/origin bypass is genuinely network-borne but user-interaction-gated and limited in impact), so this is a real-but-low-priority issue rather than a high-CVSS/low-risk mismatch. Two data caveats must be stated explicitly: the affected-package name conflicts across sources - the Description names 'connect-xcors' while the CPE names 'connect-cors' (github.com/antono) - verify the exact package with the reporter; and the 'Authentication Bypass' tag overstates the mechanism, which is CWE-346 Origin Validation Error, not an authentication bypass.

An attacker hosts a malicious web page and lures a victim who is authenticated to a Node.js/Connect application that uses the connect-cors (a.k.a. connect-xcors) middleware. Because the middleware fails to properly validate the request Origin, the attacker's page issues a cross-domain request that the browser sends with the victim's credentials, and the flawed middleware allows the response to be read or the action to proceed across origins. No public proof-of-concept is referenced; UI:P indicates the victim must merely visit or interact passively with attacker-controlled content.