The vulnerability in sanic-cors (<= 2.2.0) stems from the use of an unanchored regular expression in the try_match() function within sanic_cors/core.py. This flaw allows an attacker to bypass CORS origin allowlists by registering a domain that begins with a trusted origin string, thereby potentially gaining unauthorized access to cross-origin requests for authenticated resources. The lack of end-anchoring in the regex match leads to this bypass. No CVSS score or vendor advisory is currently available, and no patch or remediation level has been confirmed.

An attacker can bypass CORS origin allowlists by exploiting the improper regular expression, potentially gaining unauthorized access to cross-origin requests that should be restricted. This could lead to unauthorized access to authenticated resources via cross-origin requests. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional manual validation of CORS origins or implement alternative controls to restrict cross-origin access. Monitor vendor channels for updates regarding patches or official mitigations.