Description

openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T11:16:42.723Z",
  "pubdate": "2026-08-17T11:16:42.723Z",
  "executiveSummary": "A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in openssl_encrypt versions prior to 1.4.0. The vulnerability arises from improper configuration settings where allow_origins is explicitly set to a wildcard value while allow_credentials is simultaneously enabled to true. This security flaw introduces severe risk implications, allowing unauthorized third-party domains to interact with the vulnerable API under the security context of an authenticated user. The primary impact is the exposure of sensitive application data and the potential execution of unauthorized actions on behalf of the victim. An attacker possesses the capability to construct and deploy malicious external websites designed to issue cross-origin requests directly to the affected API endpoints. Successful exploitation requires the targeted user to visit the attacker-controlled website while maintaining an active authenticated session with the vulnerable application, thereby leveraging the browser's automatic credential handling to bypass perimeter defenses.",
  "technicalDetails": "The root cause of this vulnerability stems from a dangerous combination of CORS policy directives within the openssl_encrypt library prior to version 1.4.0. Specifically, the vulnerable component misconfigures HTTP response headers by returning Access-Control-Allow-Origin set to a wildcard alongside Access-Control-Allow-Credentials set to true. While specifications generally prohibit browsers from honoring a wildcard origin when credentials are requested, misinterpretations, legacy browser behaviors, or specific framework-level request handling can improperly permit authenticated cross-origin interactions. The exploitation method relies on browser-based cross-origin request forgery principles combined with credential inclusion. The attack flow commences when an authenticated user navigates to a malicious website controlled by an attacker. The malicious site executes asynchronous JavaScript requests targeting the vulnerable API endpoints exposed by the openssl_encrypt application. Because allow_credentials is enabled, the victim's browser automatically attaches session cookies, HTTP authentication tokens, or TLS client certificates to the cross-origin request despite the wildcard origin configuration. Network exposure of the API endpoints allows external web origins to reach the server directly. Upon receiving the authenticated request, the server processes the transaction using the victim's valid session context, returning sensitive data or executing state-changing operations directly to the origin controlled by the attacker. The post-exploitation impact includes unauthorized data exfiltration, compromise of sensitive user information processed by the API, and potential execution of malicious transactions on behalf of the victim without their explicit consent or awareness."
}