#auth-token-theft

Auth Token Theft via CORS Misconfiguration

A critical CORS misconfiguration allowed stealing authentication tokens by abusing a wildcard-like origin match and Access-Control-Allow-Credentials: true.