CVE-2026-18825
Received Received - Intake

Origin Validation Error in Connect-XCORS Middleware

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: TCS-CERT

Description
An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-18825
EUVD
EUVD-2026-88239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thalesgroup connect-xcors *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Origin Validation Error in the middleware of the connect-xcors npm package. It allows attackers to bypass origin verification and perform cross-domain authenticated requests.

Detection Guidance

This vulnerability is specific to the connect-xcors npm package and involves origin validation bypass. Detection requires checking for vulnerable versions of the package in your project dependencies. Use commands like 'npm list connect-xcors' or 'npm audit' to identify affected installations.

Impact Analysis

An attacker could exploit this to send unauthorized requests from a different domain, potentially accessing sensitive data or performing actions on behalf of authenticated users.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance breaches if exploited.

Mitigation Strategies

Immediately update the connect-xcors npm package to the latest patched version to address the Origin Validation Error. Review and restrict CORS policies to trusted origins only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart