The open-vsx.org service improperly configures CORS headers at the CDN/edge layer, reflecting the origin in Access-Control-Allow-Origin while setting Access-Control-Allow-Credentials to true on authenticated /user/ endpoints. This allows cross-origin credentialed requests to access sensitive user information and tokens. The vulnerability exposes multiple user-related endpoints and defeats CSRF protections by making the /user/csrf endpoint readable cross-origin. An attacker can chain these flaws to create and steal personal access tokens with elevated privileges. The Open VSX software itself does not produce this origin reflection; it is caused by the CDN/edge configuration. No official fix or patch is documented in the provided data.

An attacker can exploit this vulnerability to perform cross-origin credentialed requests from any webpage, accessing sensitive user data such as login names, avatars, tokens, namespaces, and extensions. The attacker can also bypass CSRF protections and create personal access tokens with publish and delete rights on the victim's namespaces, potentially leading to unauthorized code publishing or deletion. This compromises user account integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the issue originates from the CDN/edge layer configuration rather than the application, remediation likely involves correcting CORS header settings at the CDN or edge proxy. Until an official fix is available, restricting or disabling credentialed cross-origin requests on the affected endpoints may mitigate risk.