Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24qx-w28j-9m6p. This link is maintained to preserve external references. Original Description A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation...

GHSA-V42X-X7JP-845H Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24qx-w28j-9m6p. This link is maintained to preserve external references. Original Description A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation...

CVE-2026-6657

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

CVE-2026-6657 CORS Origin Validation Bypass in jupyter-server

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

EUVD-2026-34104

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

CVE-2026-6657

CVE-2026-6657 affects jupyter-server versions 1.12.0–2.17.0. Root cause: use of re.match() for Origin validation in allow_origin_pat, allowing attacker-controlled domains to bypass CORS checks (e.g., trusted.example.com.evil.com) across CORS headers, WebSocket, referer validation, and login redir...

CVE-2026-6657 CORS Origin Validation Bypass in jupyter-server

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

CVE-2026-6657: Origin Validation Error

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

PT-2026-45961

Name of the Vulnerable Software and Affected Versions jupyter-server versions 1.12.0 through 2.17.0 Description An issue exists when the allow origin pat configuration is used, allowing an attacker to bypass Cross-Origin Resource Sharing CORS origin validation. This occurs because the re.match...

RUSTSEC-2026-0279 Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

Rojo's rojo serve command starts an unauthenticated HTTP API on localhost default port 34872 with no Host or Origin header validation. While direct cross-origin fetch requests from a malicious website are blocked by the browser's default CORS policy, an attacker can use DNS rebinding to bypass th...

Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

Rojo's rojo serve command starts an unauthenticated HTTP API on localhost default port 34872 with no Host or Origin header validation. While direct cross-origin fetch requests from a malicious website are blocked by the browser's default CORS policy, an attacker can use DNS rebinding to bypass th...

CVE-2025-66593

An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation...

CVE-2025-66592

An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation...

CVE-2026-47265: Origin Validation Error

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might ...

Missing Origin Validation in WebSockets

Overview kanban is an A kanban foundation for coding agents Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets due to the lack of enforcement of origin and host policy. An attacker can gain unauthorized access to sensitive data and perform actions on behal...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...