CVE-2026-119285
Description
A flaw was found in Fiber. When configured with wildcard subdomains and credentials enabled, the Cross-Origin Resource Sharing (CORS) middleware improperly validates domain origins by checking only the host suffix without enforcing a proper domain boundary. A remote attacker can exploit this issue by enticing an authenticated user to visit an attacker-controlled website whose domain shares the suffix of an allowed site. Successful exploitation results in information disclosure, allowing the attacker to access authenticated responses and sensitive data from the user's session.
Statement
This vulnerability is rated as having Moderate severity because successful exploitation requires non-default application settings and user interaction, limiting the likelihood of unauthorized credentialed data access. The flaw only manifests when web services enable cross-origin credentials and rely on wildcard expressions for permitted domains, allowing third-party hosts with matching name endings to bypass access controls. Although an adversary could read private session responses if a victim visits an external landing site, normal deployments that specify exact domain origins or omit credential exchange remain unaffected.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
