{"id":"CVE-2026-54290","aliases":["GHSA-88fw-hqm2-52qc"],"title":"hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard","summary":"hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard","severity":"high","cvss":7.1,"cwe":["CWE-942"],"vendor":"hono","product":"hono","ecosystem":"npm","affected":["hono < 4.12.25"],"patched":["hono 4.12.25"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-88fw-hqm2-52qc","references":[{"url":"https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc"},{"url":"https://github.com/advisories/GHSA-88fw-hqm2-52qc"}],"tags":["ghsa","npm"],"epss":0.00328,"epssPercentile":0.261,"ingestedAt":"2026-07-07T15:41:58.357Z","slug":"CVE-2026-54290","body":"## Overview\n\n### Summary\n\nWith `credentials: true` and no explicit `origin` (the default wildcard), the CORS Middleware reflects the request's `Origin` and sends `Access-Control-Allow-Credentials: true`. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.\n\n### Details\n\nThe spec forbids `Access-Control-Allow-Origin: *` with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request `Origin` instead, so it now succeeds for every origin, including `null`. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.\n\nThis issue arises when an application enables `credentials: true` and leaves `origin` unset or set to the wildcard.\n\n### Impact\n\nAny third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting `origin`.\n\n## Affected packages\n\n- `hono < 4.12.25`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `hono 4.12.25`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}