CVE-2026-90882

Name of the Vulnerable Software and Affected Versions open-vsx.org (affected versions not specified)

Description The deployment of the service returned an Access-Control-Allow-Origin header that reflected the requesting origin combined with Access-Control-Allow-Credentials: true on authenticated endpoints. This configuration, caused by the CDN/edge layer rather than the application software, allowed pages from any origin to issue credentialed requests in a logged-in user's browser and read the responses. Affected endpoints include '/user', '/user/tokens', '/user/namespaces', '/user/extensions', '/user/search/{name}', and '/user/namespace/{name}/members'. Additionally, because the '/user/csrf' endpoint was readable, Cross-Site Request Forgery (CSRF) protections on write endpoints could be bypassed. An attacker could leverage this to call '/user/token/create' and exfiltrate a personal access token with publish and delete rights over the victim's namespaces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Rotate personal access tokens used to publish extensions.