CVE-2026-54290 describes a permissive cross-domain policy vulnerability (CWE-942) in the honojs hono framework before version 4.12.25. When the CORS middleware is configured with credentials: true and no explicit origin (defaulting to a wildcard), it reflects the request's Origin header and sends Access-Control-Allow-Credentials: true. This allows any external site to perform credentialed cross-origin requests and access sensitive responses, exposing cookie-authenticated endpoints to untrusted origins. The vulnerability is resolved in hono version 4.12.25.

The vulnerability allows arbitrary external origins to make credentialed cross-origin requests and read responses from the vulnerable hono application, potentially exposing sensitive user data protected by cookies. This can lead to unauthorized data disclosure. The CVSS score is 7.1 (high severity), indicating a network attack vector with low complexity, no privileges required, user interaction needed, and high confidentiality impact.

Upgrade hono to version 4.12.25 or later, where this vulnerability is fixed. There is no official remediation level stated beyond this fix. Patch status is confirmed by the version update. Until patched, avoid using credentials: true with the default wildcard origin in CORS middleware configurations.