PT-2026-49737 · Npm · Hono

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-54290

OSV

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Summary

With credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins.

Details

The spec forbids Access-Control-Allow-Origin: * with credentials and browsers reject it, so this configuration used to fail closed. In affected versions the middleware reflects the request Origin instead, so it now succeeds for every origin, including null. The preflight also echoes the requested headers back, approving non-simple credentialed requests too.

This issue arises when an application enables credentials: true and leaves origin unset or set to the wildcard.

Impact

Any third-party page a logged-in user visits can read the application's cookie-authenticated endpoints and perform credentialed state-changing requests. This affects applications that enable credentialed CORS without restricting origin.

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-54290

GHSA-88FW-HQM2-52QC

Affected Products

Hono

References · 3

• https://osv.dev/vulnerability/GHSA-88fw-hqm2-52qc · Vendor Advisory
• https://github.com/honojs/hono · Note
• https://github.com/honojs/hono/security/advisories/GHSA-88fw-hqm2-52qc · Note