CORS Misconfiguration
High · Access Control
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-942
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-942
Definition
Over-permissive Access-Control-Allow-Origin with credentials.
Root cause
Reflecting Origin without allow-list.
Affected components
- Components in the “Access Control” class
- Application / API handlers
- Supporting libraries
Impact
Cross-origin data theft.
Severity
High
Safe lab reproduction
PortSwigger CORS
Detection methodology
CORS header review.
Evidence examples
- Lab reproduction notes: PortSwigger CORS
- Request/response excerpts (redacted)
- Detection signal: CORS header review
Remediation
Strict origin allow-list; never * with credentials.
Secure coding examples
Server-side origin checks.
Related CYNARKS lessons & labs
Tools: burp · browser-devtools
Practise related skills in Labs or deepen on Academy library.