CVE-2026-82287

Received Received - Intake

CORS Misconfiguration in Rybbit Allows Credentialed Requests

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82287

EUVD

EUVD-2026-67818

Affected Vendors & Products

Vendor	Product	Version / Range
rybbit	rybbit	to 2.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

Rybitt before version 2.7.0 has a CORS misconfiguration that lets attackers bypass origin restrictions. It reflects any request origin in the Access-Control-Allow-Origin header while credentials are enabled, allowing credentialed cross-origin requests from any website. This can let attackers read analytics data, account information, and perform authenticated actions as the victim user.

Detection Guidance

To detect this CORS misconfiguration, inspect HTTP responses from Rybbit (before 2.7.0) for the Access-Control-Allow-Origin header reflecting arbitrary origins while credentials are enabled. Check if the header value matches the request origin or contains wildcards. Use browser developer tools or curl to inspect headers for requests to Rybbit endpoints.

Impact Analysis

If you use Rybbit before 2.7.0, attackers could access your sensitive data like analytics or account details by tricking you into visiting a malicious site. They could also perform actions on your behalf without your knowledge, such as changing settings or accessing restricted information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Rybbit to version 2.7.0 or later to address the CORS misconfiguration. If upgrading is not immediately possible, disable credentialed cross-origin requests or restrict the Access-Control-Allow-Origin header to trusted domains only. Review and update CORS policies to ensure strict origin validation.

Hi! I’m here to help you understand CVE-2026-82287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70