Cloudanix VulnDB

GHSA-c65f-x25w-62jv

High · 7.5

openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

CVSS

7.5

EPSS

—

Published

Apr 1, 2026

CISA due date

—

The record

Both standalone servers configure CORS with `allow_origins=["*"]`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities