This vulnerability in farion1231 cc-switch (up to version 3.12.3) arises from a permissive cross-domain policy implemented in the ProxyServer component's source code (src-tauri/src/proxy/server.rs). The flaw allows untrusted domains to interact with the application in ways normally restricted by cross-domain policies, potentially enabling unauthorized access or actions. The issue can be exploited remotely without user interaction. Although an exploit has been publicly released, there is no vendor-provided patch or official remediation at this time.

The vulnerability permits remote attackers to bypass cross-domain restrictions by leveraging a permissive policy that includes untrusted domains. This can lead to unauthorized access or manipulation of resources intended to be protected by same-origin policies. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact due to the nature of the vulnerability and the lack of required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or monitoring cross-domain interactions involving the affected component and avoid exposing the vulnerable versions in untrusted environments.