PT-2026-137851
CVE-2026-121821
·
Published
2026-11-06
·
Updated
2026-11-06
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
armeria versions 0.84.0 through 1.42.0
Description
Cross-Origin Resource Sharing (CORS) policies configured for any-origin do not enforce path restrictions. This allows a website controlled by an attacker to read sensitive responses from excluded paths if an authenticated victim visits the site, credentials are enabled, and the browser transmits authentication credentials.
Recommendations
Update armeria to a version later than 1.42.0.
Found an issue in the description? Have something to add? Feel free to write us 👾