CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

If a cross-domain policy file includes domains that should not be trusted, such as when using wildcards under a high-level domain, then the application could be attacked by these untrusted domains. In many cases, the attack can be launched without the victim even being aware of it.

Consequences

• Confidentiality, Integrity, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Varies by Context

How to prevent it

• Architecture and Design, Operation: Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
• Architecture and Design, Operation: Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
• Architecture and Design, Operation: For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

Recent advisories

• GHSA-vvpg-rrww-wpmh — vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
• GHSA-m687-p538-r5hp — Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
• GHSA-fp27-88fp-2phg — Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
• GHSA-v3j7-r9gq-3gjw — Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
• GHSA-87qc-fj39-wccr — Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
• GHSA-88fw-hqm2-52qc — hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
• GHSA-m837-xvxr-vqwg — Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage
• GHSA-gfc2-9qmw-w7vh — Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
• GHSA-ccq9-r5cw-5hwq — WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
• GHSA-x462-jjpc-q4q4 — PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
• GHSA-c65f-x25w-62jv — openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers
• GHSA-68p4-j234-43mv — SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
• GHSA-7p93-6934-f4q7 — Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
• GHSA-qc3p-398r-p59j — AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
• GHSA-9jfm-9rc6-2hfq — Glances's Default CORS Configuration Allows Cross-Origin Credential Theft

All advisories for CWE-942