CVE-2026-72702: Php Unanchored Referrer Prefix Checkcve-2026-72702-php-unanchored-referrer-prefix-check
Unanchored prefix validation on HTTP Referer or URL. Using `str_starts_with($referrer, $base)` without an exact match or a trailing path separator ('/') allows attackers with domains starting with the base URL string (e.g., `https://example.com.attacker.tld`) to bypass origin checks.
