CVE-2026-46608: Cors Wildcard Fallbackcve-2026-46608-cors-wildcard-fallback
When multiple CORS origins are configured, the application erroneously defaults to a wildcard ('*') instead of dynamically reflecting valid request origins. This misconfiguration silently disables cross-origin restrictions, exposing APIs. Reflect the 'Origin' request header against the allowed list of origins instead.
