EUVD-2026-60100
GHSA-243r-jm6r-f6pp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges (PR:N); victim must visit a malicious page (UI:R); confidentiality impact only, no integrity or availability effect per advisory tags.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.
AnalysisAI
CORS misconfiguration in the openssl_encrypt pip package (versions before 1.4.0) enables any website to issue fully credentialed cross-origin API requests on behalf of authenticated users, exposing sensitive API responses to attacker-controlled origins. Both standalone server components - key-server and telemetry-server - ship with the maximally permissive combination of allow_origins=["*"] and allow_credentials=True as their default configuration, propagated through docker-compose.yml and .env.example. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concrete conditions: (1) the target environment must be running one or both standalone server components (key-server or telemetry-server) from openssl_encrypt versions prior to 1.4.0; (2) the CORS_ORIGINS setting must remain at the default wildcard value (*) as shipped - any explicit non-wildcard override eliminates the vulnerability; (3) an authenticated user (with an active session or bearer token recognized by the API) must be induced to visit an attacker-controlled webpage during their session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) reflects network-accessible, low-complexity exploitation with high confidentiality impact and no integrity or availability effect - consistent with the Information Disclosure tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain and hosts a webpage with JavaScript that silently fetches sensitive endpoints on the victim's openssl_encrypt API (e.g., key retrieval or telemetry endpoints) using the Fetch API with credentials:include. When an authenticated user visits the attacker's page - via phishing, malvertising, or a compromised third-party site - the browser automatically attaches the user's session cookies or authorization tokens to the cross-origin request, and the API returns the full response to the attacker's origin. … |
| Remediation | Upgrade the openssl-encrypt pip package to version 1.4.0 or later, which resolves the issue by changing the CORS default from ["*"] to [] in both key-server and telemetry-server and adds validation that rejects wildcard origins when debug=False (commit 809416b on branch releases/1.4.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments of openssl_encrypt and confirm which versions are in use and whether allow_origins=['*'] with allow_credentials=True is active in docker-compose.yml and .env configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today