CVE-2026-121821

MediumCVSS 5.3/10Last modified Nov 10, 2026

Description

A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-942

Affected software

Vendor	Product	Versions
LY Corporation	Armeria	>= 0.84.0, < 1.43.0

References

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1218222.4A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross CVE-2026-1218238.7A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthentic CVE-2026-1218248.7A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memo CVE-2026-1218256.1OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provide CVE-2026-121839.8Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability CVE-2026-1218374.3A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @Secur CVE-2026-1218417.3Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218428.8Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218438.8Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.CVE-2026-1218488.8The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the cho CVE-2026-121858.6In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bo CVE-2026-1218535.3The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors t