Search for vulnerabilities
| Vulnerability ID | VCID-hm8x-xkx9-buam |
| Aliases |
GHSA-c65f-x25w-62jv
|
| Summary | openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers ### Summary Both standalone servers configure CORS with `allow_origins=["*"]`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`. ### Affected Code ```python # server/key-server/app/main.py:86-92 # server/telemetry-server/app/main.py:23-29 app.add_middleware( CORSMiddleware, allow_origins=settings.cors_origins, # defaults to ["*"] allow_credentials=True, allow_methods=["*"], allow_headers=["*"], ) ``` The docker-compose file (`openssl_encrypt_server/docker-compose.yml:75`) also defaults `CORS_ORIGINS` to `*`, and `.env.example` ships with `CORS_ORIGINS=*`. ### Impact This is the most permissive CORS configuration possible, allowing any website to make fully credentialed cross-origin requests to the API. An attacker's website could make authenticated API calls on behalf of any user who visits it. ### Recommended Fix - Remove wildcard defaults — require explicit origin configuration - Never combine `allow_origins=["*"]` with `allow_credentials=True` - Update `.env.example` with placeholder domains instead of `*` ### Fix Fixed in commit `809416b` on branch `releases/1.4.x` — changed CORS default from ["*"] to [] in both key-server and telemetry-server; added validation rejecting wildcard when debug=False. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.2 |
| Risk | 3.1 |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1_qr | MODERATE | https://github.com/advisories/GHSA-c65f-x25w-62jv |
| cvssv4 | 6.6 | https://github.com/jahlives/openssl_encrypt |
| generic_textual | MODERATE | https://github.com/jahlives/openssl_encrypt |
| cvssv4 | 6.6 | https://github.com/jahlives/openssl_encrypt/commit/809416b74d2749cdcffb484cd65b057e1685cc13 |
| generic_textual | MODERATE | https://github.com/jahlives/openssl_encrypt/commit/809416b74d2749cdcffb484cd65b057e1685cc13 |
| cvssv3.1_qr | MODERATE | https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c65f-x25w-62jv |
| cvssv4 | 6.6 | https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c65f-x25w-62jv |
| generic_textual | MODERATE | https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c65f-x25w-62jv |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
No EPSS data available for this vulnerability.
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-12T07:45:14.098039+00:00 | GithubOSV Importer | Import | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c65f-x25w-62jv/GHSA-c65f-x25w-62jv.json | 38.6.0 |