What Is a CORS Vulnerability and How Does It Affect Your Website?

What is a CORS vulnerability and how does it affect your website?

CORS — Cross-Origin Resource Sharing — is a security mechanism built into web browsers that controls which websites can make requests to your server. It exists to prevent malicious websites from making requests to your API or web application using a visitor's credentials without their knowledge.

When CORS is configured incorrectly, it can create serious vulnerabilities that allow attackers to bypass the protections it was designed to provide.

What CORS is and why it matters

Browsers enforce a security policy called the same-origin policy: a script running on website-a.com cannot by default make requests to website-b.com and read the response. This prevents malicious sites from secretly accessing your bank account, your email, or your application data by making requests that your browser would authenticate automatically.

CORS allows servers to explicitly relax this restriction for specific, trusted origins. A web application at app.company.com might configure CORS to allow requests from dashboard.company.com — a legitimate business need.

The vulnerability arises when CORS is configured too permissively.

How CORS misconfigurations create vulnerabilities

The most dangerous CORS misconfiguration is reflecting the Origin header — accepting any origin that claims permission. Some developers, to avoid CORS errors during development, configure their server to automatically trust whatever origin a request claims to come from.

An attacker who discovers this can create a malicious website that makes requests to your API. When a victim visits the attacker's site while logged into your application, the malicious site can make authenticated requests to your API and read the responses — extracting account information, personal data, or anything else the API exposes.

A wildcard CORS configuration — allowing any origin — has the same effect for APIs that do not require cookies for authentication.

What data can be stolen through a CORS vulnerability

The answer depends on what your API exposes. For a SaaS application, a CORS vulnerability could allow an attacker to read any data the logged-in user can access — their profile, their transactions, their account settings, other users' data if there are also authorisation weaknesses.

For an e-commerce site, it could expose order history, delivery addresses, and saved payment method details.

How CORS gets fixed

The fix is to explicitly list the origins that are permitted to make cross-origin requests, rather than reflecting or wildcarding. Your server should only respond with CORS headers for origins on an approved list, and that list should include only the domains that legitimately need access.

Dynamic origin validation — where the server checks whether the origin is in a whitelist before including it in the response — is the correct implementation.

Yrzo AI tests for CORS misconfigurations as one of its 44 automated security checks. Starting at £399 for a full scan with plain-English report.