@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

CVE-2026-59148

The CVE covers Mockoon prior to version 9.7.0, where the admin API was mounted on the same Express listener as user mock routes with default-enabled, unauthenticated access and permissive CORS (Access-Control-Allow-Origin: ). This allowed any unauthenticated client on the mock server port to: rea...

CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...