CVE-2026-82287: falha de alta gravidade em rybbit-io rybbit
Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.5%
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
rybbit-io · rybbitReferências
https://github.com/rybbit-io/rybbithttps://github.com/rybbit-io/rybbit/blob/v2.6.0/server/src/index.tshttps://github.com/rybbit-io/rybbit/commit/6f1039bdd3328a84d6700031bc0ce4714020e2f9https://github.com/rybbit-io/rybbit/issues/1038https://www.vulncheck.com/advisories/rybbit-reflects-any-origin-in-cors-responses-while-allowing-credentials