CVE-2025-50864
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The elysia-cors library through version 1.3.0 has an origin validation error that allows bypassing CORS restrictions. Instead of exact domain matching, the library checks if the supplied origin is a substring of any domain in the CORS policy, enabling attackers to use malicious origins like "notexample.com" or "example.common.net" when the policy includes "example.com".
Risk Assessment
An attacker can gain unauthorized access to user data in applications using this library, leading to confidentiality breaches and potential session theft or exposure of sensitive information.
Recommendation
Immediately update the elysia-cors library to a version newer than 1.3.0 that fixes the origin validation. If an update is not possible, implement custom exact domain matching in the CORS configuration.
Original NVD description (English source)
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation.