CVE-2026-82287: Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rybbitto a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
Which deployments are affected?
Rybbit versions before 2.7.0 are affected. The issue applies where the vulnerable server accepts cross-origin requests and a victim has credentials for that Rybbit deployment.
What does an attacker need to exploit this?
An attacker does not need prior privileges, but must persuade a logged-in victim to interact with an attacker-controlled website. That site can then make credentialed cross-origin requests to the vulnerable Rybbit server as the victim.
What could an attacker do through a victim's session?
The attacker can read analytics data and account information available to the victim. They can also perform authenticated state-changing operations with the victim's credentials.
What is the remediation?
Upgrade Rybbit to version 2.7.0 or later. Versions before 2.7.0 should be treated as vulnerable to credentialed cross-origin access from arbitrary origins.