CVE-2026-89058

Name of the Vulnerable Software and Affected Versions RESTEasy (affected versions not specified)

Description A flaw exists in the CorsFilter component. When configured to allow all origins using the "*" wildcard, the filter reflects the request's Origin header in the Access-Control-Allow-Origin response while simultaneously setting Access-Control-Allow-Credentials to true. This configuration enables a malicious website to perform credentialed cross-origin requests and access authenticated responses from a user's session, leading to a loss of confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.