{"id":27432,"date":"2026-09-22T20:30:52","date_gmt":"2026-09-22T12:30:52","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90882"},"modified":"2026-09-22T20:30:52","modified_gmt":"2026-09-22T12:30:52","slug":"cve-2026-90882","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90882","title":{"rendered":"CVE-2026-90882 &#8211; The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting"},"content":{"rendered":"<p>The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated \/user\/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user&#8217;s browser and read the responses.<\/p>\n<p>This exposed \/user (login name, avatar, homepage, tokens URL), \/user\/tokens, \/user\/namespaces, \/user\/extensions, \/user\/search\/{name} and \/user\/namespace\/{name}\/members, and \u2014 because \/user\/csrf was readable the same way \u2014 allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call \/user\/token\/create and exfiltrate a personal access token carrying publish and delete rights over the victim&#8217;s namespaces.<\/p>\n<p>The headers were emitted by the CDN\/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on \/user\/ beyond it. No configuration of the software produces origin reflection with credentials.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated \/user\/ endpoints. A page on <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-27432","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/27432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=27432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=27432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=27432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}