vantage6's CORS settings overly permissive

GHSA-4946-85pr-fvxh · CVE-2024-23823 · PYSEC-2024-326 · PYSEC-2026-2004

Published Mar 15, 2024 · Modified Sep 10, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.

The impact is limited because v6 does not use session cookies

Patches

Workarounds

References

WEB https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-23823
WEB https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41
PACKAGE https://github.com/vantage6/vantage6

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes