CVE-2026-27192: Insecure Origin Validation Startswithcve-2026-27192-insecure-origin-validation-startswith
Validating an origin or domain by checking if a string starts with an allowed origin is insecure. An attacker can bypass this check by registering a domain that shares the same prefix (e.g., `https://target.com.attacker.com` starts with `https://target.com`). Parse the input using `new URL()` and check for exact equality against `url.origin` or `url.hostname
