CVE-2026-54290High· 7.1▾ Twilighthono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.
The spec forbids Access-Control-Allow-Origin: * with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request Origin instead, so it now succeeds for every origin, including null. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.
This issue arises when an application enables credentials: true and leaves origin unset or set to the wildcard.
Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting origin.
hono < 4.12.25Upgrade to a patched release:
hono 4.12.25Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84363Medium· 5.9Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84364Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84365Medium· 6.5Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-71848Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-71849Low· 3.7Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-71850Medium· 4.8Hono is a Web application framework that provides support for any JavaScript runtime