The elysia-cors library through version 1.3.0 suffers from an origin validation error where the supplied origin is checked as a substring of allowed domains instead of an exact match. This flaw allows malicious origins such as "notexample.com" or "example.common.net" to be incorrectly accepted when the policy specifies "example.com." As a result, attackers can bypass CORS restrictions and potentially access user data on sites using this library for CORS validation. The vulnerability is tracked as CVE-2025-50864 and is associated with CWE-178 (Improper Neutralization of Argument Delimiters in a Command).

This vulnerability enables attackers to bypass Cross-Origin Resource Sharing (CORS) policies, potentially allowing unauthorized websites to access sensitive user data from affected sites. While it does not impact confidentiality directly via network access, it compromises the integrity of CORS enforcement, increasing the risk of data exposure through unauthorized cross-origin requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing strict origin validation outside of the elysia-cors library or avoid using affected versions (<=1.3.0).