CVE-2026-54290

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.25

Description The CORS Middleware reflects the request Origin and sends Access-Control-Allow-Credentials: true when credentials: true is enabled and no explicit origin is defined (defaulting to the wildcard). This allows any site to make credentialed cross-origin requests and read responses, exposing cookie-authenticated endpoints to arbitrary origins. The middleware reflects the request Origin instead of using a wildcard, which bypasses browser restrictions that normally forbid Access-Control-Allow-Origin: * with credentials. Additionally, the preflight process echoes requested headers, approving non-simple credentialed requests.

Recommendations Update to version 4.12.25. Restrict the origin setting to specific trusted domains instead of using the wildcard when credentials: true is enabled.