---
id: CVE-2026-90882
title: >-
  The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting
  the requesting origin together with Access-Control-Allow-Credentials: true on
  the authenticated /user/ endpoints
summary: >-
  The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting
  the requesting origin together with Access-Control-Allow-Credentials: true on
  the authenticated /user/ endpoints. A page on any origin could therefore issue
  cred…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-942
vendor: Eclipse Foundation
product: open-vsx.org
affected:
  - open-vsx.org >= 29/04/2026 <= 07/09/2026
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:09:58.680'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90882'
references:
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/289'
    label: emo@eclipse.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T13:06:04.901059Z'
cvssSource: cna
ingestedAt: '2026-09-22T10:01:43.993Z'
epss: 0.00422
epssPercentile: 0.36205
---

## Overview

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses.



This exposed /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name} and /user/namespace/{name}/members, and — because /user/csrf was readable the same way — allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call /user/token/create and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces.



The headers were emitted by the CDN/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. No configuration of the software produces origin reflection with credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.