CVE-2026-90882
Received Received - Intake

Open VSX CORS Misconfiguration Exposes User Data

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Eclipse Foundation

Description
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses. This exposed /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name} and /user/namespace/{name}/members, and — because /user/csrf was readable the same way — allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call /user/token/create and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces. The headers were emitted by the CDN/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. No configuration of the software produces origin reflection with credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-90882
EUVD
EUVD-2026-84343

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open_vsx open_vsx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the open-vsx.org service returning Access-Control-Allow-Origin headers that reflect the requesting origin along with Access-Control-Allow-Credentials set to true on authenticated /user/** endpoints. This allowed any webpage from a different origin to make credentialed requests in a logged-in user's browser and read sensitive responses.

Detection Guidance

To detect this vulnerability, check if your open-vsx.org deployment or similar services return Access-Control-Allow-Origin headers reflecting arbitrary origins with Access-Control-Allow-Credentials set to true on /user/** endpoints. Use curl to inspect headers for these endpoints. Example command: curl -I -H 'Origin: https://attacker.com' https://open-vsx.org/user/tokens

Verify if sensitive data like tokens or user details are exposed by making requests from different origins and checking responses. Also inspect CDN/edge layer configurations for improper CORS settings.

Impact Analysis

An attacker could exploit this to read sensitive user data like login names, avatars, homepages, tokens, namespaces, extensions, and membership details. They could also bypass CSRF protection and create personal access tokens with publish and delete permissions over your namespaces.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data such as login names, tokens, and personal access credentials. For GDPR, this may violate principles of data minimization and security, potentially resulting in unauthorized data exposure. For HIPAA, exposure of user tokens or credentials could compromise protected health information if such data was accessible through these endpoints.

Mitigation Strategies

Immediately disable Access-Control-Allow-Credentials and origin reflection in the CDN/edge layer for /user/** endpoints. Ensure CORS is configured to allow only trusted origins. Update Open VSX software to restrict allowCredentials(true) to the exact origin specified in ovsx.webui.url.

Rotate all exposed personal access tokens and review namespace permissions. Monitor for unauthorized token creation or data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart