What is the CVSS score of CVE-2026-25478?

CVE-2026-25478 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Litestar are affected by CVE-2026-25478?

A vulnerability in Litestar's CORS validation (CVE-2026-25478) could allow attackers to bypass origin restrictions and access APIs from unauthorized domains, potentially exposing sensitive data or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25478?

Yes, a public proof-of-concept exploit is available for CVE-2026-25478. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25478?

Within 24 hours: Inventory all systems running Litestar and identify those with versions <2.20.0; prioritize public-facing APIs. Within 7 days: Apply vendor patch to 2.20.0 or later on all affected systems, beginning with production environments handling sensitive data. Within 30 days: Conduct CORS configuration audits to verify allowlist values are correctly specified and test origin validation post-patching.

Litestar CVE-2026-25478

HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-02-09 security-advisories@github.com

GHSA-2p2x-hpg8-cqp2

Information Disclosure Litestar

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 17, 2026 - 15:15 vuln.today

Public exploit code

Patch released

Feb 17, 2026 - 15:15 nvd

Patch available

CVE Published

Feb 09, 2026 - 20:15 nvd

HIGH 7.4

DescriptionGitHub Advisory

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.

AnalysisAI

Litestar ASGI framework versions before 2.20.0 fail to properly escape regex metacharacters in CORS origin validation, allowing attackers to bypass origin restrictions through crafted malicious origins. This configuration flaw affects cross-origin request filtering and enables unauthorized cross-origin access. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious origin with regex metacharacters

Exploit

Send CORS preflight request

Execution

Bypass origin validation via regex injection

Impact

Access restricted cross-origin resources

Access

Craft malicious origin with regex metacharacters

Exploit

Send CORS preflight request

Execution

Bypass origin validation via regex injection

Impact

Access restricted cross-origin resources

Vulnerability AssessmentAI

Exploitation	Litestar ASGI framework versions prior to 2.20.0 with CORSConfig.allowed_origins_regex enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.4 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running Litestar and identify those with versions <2.20.0; prioritize public-facing APIs. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-25478 vulnerability details – vuln.today

Back

Litestar CVE-2026-25478

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code