CVE-2026-37737: Sanic-CORS Auth Bypass Vulnerability

CVE-2026-37737 Overview

CVE-2026-37737 affects sanic-cors version 2.2.0 and prior, a Cross-Origin Resource Sharing (CORS) middleware for the Sanic Python web framework. The vulnerability resides in the try_match() function in sanic_cors/core.py, which uses re.match without end-anchoring the regular expression. Attackers can register a domain that begins with a trusted origin string and bypass the CORS origin allowlist. This grants unauthorized cross-origin access to authenticated resources protected by the affected middleware. The flaw is tracked under CWE-346: Origin Validation Error.

Critical Impact
An attacker-controlled origin matching the prefix of an allowlisted domain can read authenticated cross-origin responses, exposing session data and protected API content.

Affected Products

sanic-cors versions 2.2.0 and prior
Sanic web applications that rely on sanic-cors for CORS allowlist enforcement
Python services distributed via the PyPI Sanic-Cors package

Discovery Timeline

2026-06-05 - CVE-2026-37737 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-37737

Vulnerability Analysis

The sanic-cors middleware compiles each entry in the configured origin allowlist into a regular expression. When an incoming request arrives, try_match() calls re.match against the Origin header. Python's re.match anchors the pattern only at the start of the string, not the end. As a result, any origin whose prefix satisfies the pattern passes validation, regardless of trailing characters.

For example, an allowlist entry intended to permit https://trusted.example.com will also match attacker-controlled origins such as https://trusted.example.com.attacker.tld. The middleware then echoes the attacker origin back in the Access-Control-Allow-Origin response header. Browsers consider the response policy-compliant and deliver authenticated content to scripts running on the malicious site.

Exploitation requires user interaction, typically a victim visiting an attacker-controlled page while authenticated to the protected application. Confidentiality of cross-origin data is the primary impact; integrity and availability are not affected.

Root Cause

The root cause is the use of re.match without an explicit end-of-string anchor ($ or \Z) in try_match() within sanic_cors/core.py. The function treats a partial prefix match as a full match, violating the same-origin trust model that CORS allowlists are intended to enforce.

Attack Vector

An attacker registers a domain whose label sequence begins with the literal text of a trusted origin. The attacker hosts a page that issues authenticated cross-origin requests (using credentials: 'include') to the target application. The vulnerable middleware accepts the forged Origin header, returns the requested resource with permissive CORS headers, and the attacker script reads the response.

The vulnerability mechanism is documented in the GitHub Security Advisory CVE-2026-37737 and the affected logic is visible in the sanic_cors/core.py source file.

Detection Methods for CVE-2026-37737

Indicators of Compromise

Inbound HTTP requests carrying Origin headers whose hostname is a superstring of an allowlisted domain, such as trusted.example.com.attacker.tld.
Response logs showing Access-Control-Allow-Origin values that do not exactly match any configured allowlist entry.
Unexpected cross-origin reads of authenticated endpoints from domains not present in deployment configuration.

Detection Strategies

Audit application access logs for Origin header values containing additional labels appended to known-trusted hostnames.
Inventory Python dependencies and flag any project that pins sanic-cors<=2.2.0 in requirements.txt, Pipfile.lock, or poetry.lock.
Run software composition analysis against deployed containers and virtual environments to identify the vulnerable package version.

Monitoring Recommendations

Alert on anomalous Origin header patterns at the reverse proxy or web application firewall layer.
Track CORS preflight (OPTIONS) traffic and correlate allowed origins against an authoritative allowlist.
Continuously scan source repositories and build artifacts for vulnerable sanic-cors versions.

How to Mitigate CVE-2026-37737

Immediate Actions Required

Upgrade sanic-cors to a fixed release once published by the maintainer; track the sanic-cors repository for the patched version.
Replace regex-based origin entries with exact-string comparisons where feasible.
Restrict CORS allowlists to the minimum set of hostnames required by the application.

Patch Information

At the time of NVD publication on 2026-06-05, no fixed version is listed in the CVE record. Monitor the PyPI Sanic-Cors package page and the upstream project for a release that anchors the regular expression in try_match().

Workarounds

Override try_match() or wrap the middleware to compare the parsed Origin host against the allowlist using exact string equality.
When regex matching is required, ensure every pattern ends with \Z or $ and escape literal dots in domain names.
Disable credentialed CORS responses for endpoints that do not require cross-origin authentication.
Enforce origin validation at an upstream proxy until the library is patched.

bash

# Configuration example: pin to a future patched release and audit installed version
pip install --upgrade 'Sanic-Cors>2.2.0'
pip show Sanic-Cors | grep -i version