{"id":"CVE-2026-121821","published":"2026-11-06T08:17:20.577","lastModified":"2026-11-06T08:17:20.577","description":"A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8","tags":[]},{"url":"https://line.github.io/security-advisory-blog/CVE-2026-121821/","tags":[]}],"exploitRefs":[{"url":"https://github.com/line/armeria/security/advisories/GHSA-386q-mrg6-jfj8","tags":[]}],"hasPoc":true,"ai":null}