CVE-2025-50864: Insecure Cors Origin Substringcve-2025-50864-insecure-cors-origin-substring
Insecure origin validation using a substring match. When validating CORS origins without a protocol schema, using a substring match logic (`.includes` or `indexOf`) allows attackers to bypass restrictions by using a malicious domain that unexpectedly contains the allowed origin as a substring (e.g., `notexample.com` bypasses `example.com`). Use exact string
