CVE-2026-121821 | BDVDB-2026-401169 Detail

Description#

A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-06Record published in the CVE List.