{"id":"GHSA-88fw-hqm2-52qc","revision":"8f06a3767dbe4922b4c9673edcac7609","records":[{"revision":"8f06a3767dbe4922b4c9673edcac7609","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-88fw-hqm2-52qc","aliases":["CVE-2026-54290"],"title":"hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard","description":"### Summary\n\nWith `credentials: true` and no explicit `origin` (the default wildcard), the CORS Middleware reflects the request's `Origin` and sends `Access-Control-Allow-Credentials: true`. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.\n\n### Details\n\nThe spec forbids `Access-Control-Allow-Origin: *` with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request `Origin` instead, so it now succeeds for every origin, including `null`. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.\n\nThis issue arises when an application enables `credentials: true` and leaves `origin` unset or set to the wildcard.\n\n### Impact\n\nAny third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting `origin`.","state":0,"publishedAt":"2026-06-16T14:15:39+00:00","modifiedAt":"2026-09-10T03:50:48.9396745+00:00","affected":[{"ecosystem":"npm","name":"hono","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.12.25"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc","https://nvd.nist.gov/vuln/detail/CVE-2026-54290","https://github.com/honojs/hono"],"sourceUrl":"https://github.com/advisories/GHSA-88fw-hqm2-52qc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-88fw-hqm2-52qc","identifiers":["GHSA-88fw-hqm2-52qc","CVE-2026-54290"]},"retained":false,"historicalAffected":[]}],"coverage":[]}