#cors

Auth Token Theft via CORS Misconfiguration

A critical CORS misconfiguration allowed stealing authentication tokens by abusing a wildcard-like origin match and Access-Control-Allow-Credentials: true.