A dangerous CORS misconfiguration is when a server responds with Access-Control-Allow-Origin set to "*" or reflects back whatever Origin header the requester sent, while also setting Access-Control-Allow-Credentials: true. That combination lets any website make an authenticated, cookie-bearing request to your API from a visitor's browser and read the response — effectively letting any third-party site act as a logged-in user against your backend.
Why the combination is the actual danger
Access-Control-Allow-Origin: * on its own is common and usually fine for public, unauthenticated APIs — it just means any site can read the response, which is often the intended behavior for public data. The danger appears specifically when that permissive origin policy is paired with Access-Control-Allow-Credentials: true, because that tells the browser it's safe to send the user's cookies (their session) along with the cross-origin request. A malicious site can then quietly make requests to your API as that logged-in user and read back whatever the API returns.
Browsers actually block the literal combination of Allow-Origin: * with Allow-Credentials: true, which is why the vulnerable pattern in practice is a server that reflects the requester's Origin header verbatim instead of using a wildcard — that passes the browser's check while still allowing any origin through.
How this shows up in generated backends
A common pattern in scaffolded APIs is a CORS middleware configured with origin: true or a function that echoes req.headers.origin, combined with credentials: true, because that's the fastest way to make cross-origin requests "just work" during development against a frontend on a different port. It keeps working identically in production unless someone deliberately tightens it.
How to fix it
Replace the wildcard or reflected origin with an explicit allow-list of the specific origins that legitimately need credentialed access — your own frontend domain(s), not a dynamic echo of whatever origin asked.
Frequently asked
Is Access-Control-Allow-Origin: * always a vulnerability?
No. It's expected and safe for public, unauthenticated endpoints. It only becomes a real risk when it's combined with Access-Control-Allow-Credentials: true (or with a reflected-origin equivalent), because that's what exposes authenticated/cookie-based data to any site.