{"id":"CVE-2026-90882","published":"2026-09-22T10:17:10.000","lastModified":"2026-09-22T19:09:58.680","description":"The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses.\n\n\n\nThis exposed /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name} and /user/namespace/{name}/members, and — because /user/csrf was readable the same way — allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call /user/token/create and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces.\n\n\n\nThe headers were emitted by the CDN/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. No configuration of the software produces origin reflection with credentials.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-942"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/289","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}