Rybbit
Monthly
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.