CVE-2026-82287: CORS Misconfiguration in Rybbit

Rybbit versions prior to 2.7.0 are vulnerable to a Cross-Origin Resource Sharing (CORS) misconfiguration (CVE-2026-82287). The application improperly validates request origins, reflecting any provided origin in the Access-Control-Allow-Origin response header while simultaneously allowing credentials (Access-Control-Allow-Credentials: true). This vulnerability allows an attacker to craft a malicious website that forces an authenticated Rybbit user's browser to send credentialed requests to the Rybbit application. The server's response allows the attacker's origin to read sensitive data, including analytics and account information. Furthermore, because credentials are included, the attacker can execute authenticated state-changing operations on behalf of the victim, such as modifying account settings or exfiltrating private data. This poses a significant risk to user confidentiality and account integrity.

Impact

Successful exploitation allows unauthenticated attackers to bypass origin restrictions to perform unauthorized actions as an authenticated user. This results in the exposure of sensitive analytics and user account information, and potential account takeover or unauthorized state changes within the application. The impact is assessed at a CVSS v3.1 base score of 8.1, indicating a high level of risk to confidentiality and integrity for users of Rybbit deployments.

Recommendation

Prioritized actions for security teams managing Rybbit instances:

• Upgrade Rybbit to version 2.7.0 or later immediately to resolve the CORS misconfiguration vulnerability identified in CVE-2026-82287.
• Review web server and application logs for suspicious cross-origin requests originating from unknown or unauthorized domains attempting to access sensitive API endpoints.
• Implement a strict, allow-list-based CORS policy in the application configuration if an immediate upgrade is not feasible, ensuring that only trusted domains are reflected in the Access-Control-Allow-Origin header.