What is the CVSS score of CVE-2026-25478?

CVE-2026-25478 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Litestar are affected by CVE-2026-25478?

A vulnerability in Litestar's CORS validation (CVE-2026-25478) could allow attackers to bypass origin restrictions and access APIs from unauthorized domains, potentially exposing sensitive data or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25478?

Yes, a public proof-of-concept exploit is available for CVE-2026-25478. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25478?

Within 24 hours: Inventory all systems running Litestar and identify those with versions <2.20.0; prioritize public-facing APIs. Within 7 days: Apply vendor patch to 2.20.0 or later on all affected systems, beginning with production environments handling sensitive data. Within 30 days: Conduct CORS configuration audits to verify allowlist values are correctly specified and test origin validation post-patching.

Litestar CVE-2026-25478

HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-02-09 security-advisories@github.com

GHSA-2p2x-hpg8-cqp2

Information Disclosure Litestar

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 15:15 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 15:15 nvd

Patch available

CVE Published

Feb 09, 2026 - 20:15 nvd

HIGH 7.4

DescriptionGitHub Advisory

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.

AnalysisAI

Litestar ASGI framework versions before 2.20.0 fail to properly escape regex metacharacters in CORS origin validation, allowing attackers to bypass origin restrictions through crafted malicious origins. This configuration flaw affects cross-origin request filtering and enables unauthorized cross-origin access. Public exploit code exists for this vulnerability.

Technical ContextAI

Affects Litestar. Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.