CVE-2025-9292
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Feb 13, 2026
CISA due date
—
The record
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-53649 Joro is a web exploitation framework. CWE-942
- CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942
- CVE-2026-63407 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-942
- CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and… CWE-942
- CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected… CWE-942
- CVE-2026-21761 HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. CWE-942
- CVE-2026-59148 Mockoon provides way to design and run mock APIs. CWE-942
- CVE-2026-59726 Ruflo is an agent meta-harness for Claude Code and Codex. CWE-942