Threats tagged 'ghsa-g5jq-qmqr-qrwf'

A vulnerability in Fiber v2.52.1 and v2.52.2 CORS middleware allowed wildcard origins to be matched incorrectly without enforcing a dot boundary or scheme check. This caused origins with hosts ending in the base domain, but not actual subdomains (e.g., https://evil-example.com for https://*.example.com), to be reflected in Access-Control-Allow-Origin with credentials allowed. The issue was fixed in v2.52.3 by improving the origin matching logic.