From a finding
to a fix.
A real client assessment, anonymized for public review. See how we document findings and explain what to fix.
A finding you
can act on.
This is a real, anonymized client assessment. Client identifiers and sensitive evidence are redacted, and some findings have been removed to protect confidentiality.
31 pages · English · Anonymized
CORS misconfiguration with credentials
Web application / Access control · CWE-942
Another website could read your users’ data.
The server reflects any requesting origin and allows credentials. If a signed-in user opens a malicious website, that site may read sensitive authenticated responses, provided the browser sends the user’s credentials and the endpoint accepts the request.
Any origin reflected, with credentials allowed.
The report records responses that return the requesting origin in the Access-Control-Allow-Origin header together with Access-Control-Allow-Credentials: true.
Client-specific responses and reproduction evidence are redacted in the downloadable sample. This page summarizes the assessment; it is not a live test.
Headers alone do not prove exploitation: cookie policy, endpoint authentication and request tokens decide whether data can be read, and the redacted sample does not demonstrate them.
Allow only your own origins.
Return Access-Control-Allow-Origin only for an explicit allowlist of your own domains, and remove Access-Control-Allow-Credentials unless your own frontend needs it. Check plugins that add CORS headers on their own. Then repeat the request with an arbitrary Origin: the response must not contain Access-Control-Allow-Origin.
Inside your report
Scope and context
The tested assets, access levels, assessment period and limitations.
Prioritized findings
Confirmed vulnerabilities, their severity and the business or technical impact.
Evidence and remediation
Conditions for reproduction, supporting evidence and recommended corrective action.
About this example
This 31-page sample covers an external assessment, including web configuration, TLS, DNS, email controls and WordPress. Some findings and evidence were removed before publication. Original finding IDs are retained, so their prefixes may differ from the revised severity. Numeric scores were reconciled with the supplied CVSS 3.1 vectors; redacted evidence has not been independently revalidated. The scope of your engagement is agreed separately.