CVE-2026-82291: Cors Origin Reflection With Credentialscve-2026-82291-cors-origin-reflection-with-credentials
CORS is configured with `origin: true` (which reflects any request origin) together with `credentials: true`. This allows any untrusted domain to make authenticated cross-origin requests and access sensitive data. Use an explicit origin whitelist or origin validation function instead of reflecting the Origin header.
