Rybbit CVE-2026-82287

Exploitation requires three concurrent conditions: (1) the target Rybbit instance is running a version prior to 2.7.0 with the default CORS configuration - no non-default setup is needed, the flaw is present in all pre-2.7.0 deployments; (2) the victim holds an active authenticated browser session to that Rybbit instance; and (3) the victim's browser can reach the Rybbit server origin from the attacker's page (i.e., the server is publicly accessible or the victim is on a network with access to an internal deployment). The primary limiting factor is UI:P - the victim must be socially engineered into loading the attacker's page during an active session. The Rybbit server itself requires no special feature to be enabled and no non-default configuration to be vulnerable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, score 8.6) accurately represents the threat: the exploit is network-reachable, requires no attacker privileges, involves no special attack conditions, and delivers high confidentiality and integrity impact against the vulnerable system. UI:P is correctly set - the victim must load an attacker-controlled page while holding an active session, introducing a social-engineering dependency. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC is referenced, indicating no confirmed active exploitation at time of analysis. The vulnerability's scope is contained to the Rybbit instance (SC:N/SI:N), meaning successful exploitation does not directly pivot into adjacent systems. Real-world priority should be high for organizations where Rybbit administrators or data consumers are targeted by phishing, and lower where the Rybbit instance is isolated to an internal network inaccessible from arbitrary external pages.

An attacker registers a domain and hosts a page containing JavaScript that issues fetch('https://analytics.victim.com/api/sites/1/sessions', {credentials: 'include'}). When an authenticated Rybbit user visits this page, the browser sends the request with the user's session cookies; Rybbit reflects the attacker's origin in Access-Control-Allow-Origin and returns Access-Control-Allow-Credentials: true, causing the browser to expose the full JSON response to the attacker's script. The same technique can be used against mutating endpoints such as site deletion, enabling authenticated state changes.