CVE-2026-82287: Rybbit CORS Auth Bypass Vulnerability

CVE-2026-82287 Overview

CVE-2026-82287 is a Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability in Rybbit versions before 2.7.0. The server reflects any request origin in Access-Control-Allow-Origin response headers while Access-Control-Allow-Credentials remains enabled. This combination breaks the browser's same-origin protections. Attackers can host a malicious page that issues credentialed cross-origin requests against a Rybbit instance where the victim is authenticated. The attacker can then read analytics data, extract account information, and execute state-changing operations on behalf of the victim. The weakness is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Any attacker-controlled website can silently perform authenticated actions and exfiltrate analytics or account data from a logged-in Rybbit user.

Affected Products

Rybbit analytics platform versions prior to 2.7.0
Rybbit v2.6.0 server component (server/src/index.ts)
Self-hosted and cloud Rybbit deployments running vulnerable releases

Discovery Timeline

2026-08-28 - CVE-2026-82287 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82287

Vulnerability Analysis

Rybbit's HTTP server accepts any value supplied in the Origin request header and echoes it back in the Access-Control-Allow-Origin response header. Because Access-Control-Allow-Credentials: true is also sent, browsers permit the response to be read by the requesting page and include session cookies with the request. This defeats the CORS trust boundary, which is designed to prevent one origin from reading another origin's authenticated responses.

The issue affects any endpoint that relies on cookie-based session authentication, including analytics queries, account settings, and administrative operations. A victim only needs to visit a malicious page while logged in to a Rybbit instance for the attacker to pivot.

Root Cause

The CORS handler in server/src/index.ts did not enforce an allowlist of trusted origins. Instead, it reflected the incoming Origin header without validation. The upstream fix introduces a createCorsOptionsDelegate and a createRejectUntrustedOriginHook, backed by a getTrustedCorsOrigins helper in server/src/lib/cors.ts, to restrict origins to a configured trust list.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled page while holding an active Rybbit session. The malicious page issues fetch requests with credentials: "include" to the Rybbit API. Because the server reflects the malicious origin and permits credentials, the browser returns the authenticated response to attacker JavaScript. User interaction is limited to visiting the page.

typescript

// Patch snippet - server/src/index.ts
import { createCorsOptionsDelegate, createRejectUntrustedOriginHook } from "./lib/cors.js";
import { IS_CLOUD } from "./lib/const.js";

// Patch snippet - server/src/lib/auth.ts
import { getTrustedCorsOrigins } from "./cors.js";

Source: Rybbit commit 6f1039b. The patch replaces reflective CORS handling with a delegate that validates the request origin against a trusted list before granting credentialed access.

Detection Methods for CVE-2026-82287

Indicators of Compromise

Rybbit access logs containing requests with unfamiliar or randomly generated Origin header values that receive Access-Control-Allow-Origin reflections.
Bursts of authenticated API requests to analytics or account endpoints originating from browsers immediately after external referrers.
Session activity showing state changes (settings modifications, site additions) without corresponding first-party UI navigation.

Detection Strategies

Inspect HTTP response headers on Rybbit endpoints and flag any response where Access-Control-Allow-Origin echoes the request Origin while Access-Control-Allow-Credentials is true.
Correlate web server logs with browser referrer data to identify cross-origin credentialed calls that reach authenticated API paths.
Alert on the Rybbit server version reported by deployments; any instance below 2.7.0 should be treated as vulnerable.

Monitoring Recommendations

Forward Rybbit server access and audit logs to a centralized SIEM or data lake and retain the Origin, Referer, and response CORS headers.
Monitor for authentication anomalies such as sensitive account changes performed within seconds of a first request from a new external origin.
Track outbound requests from user browsers to Rybbit endpoints from non-approved domains via web proxy or DNS telemetry.

How to Mitigate CVE-2026-82287

Immediate Actions Required

Upgrade all Rybbit deployments to version 2.7.0 or later, which enforces a trusted-origin allowlist.
Invalidate active user sessions after upgrade to force re-authentication and reduce risk from any pre-existing token abuse.
Review recent audit logs for suspicious authenticated actions or configuration changes attributed to end users.

Patch Information

The fix is delivered in Rybbit 2.7.0 via commit 6f1039bdd3328a84d6700031bc0ce4714020e2f9. It replaces the reflective CORS handler with createCorsOptionsDelegate and createRejectUntrustedOriginHook, driven by a configurable trusted-origins list in server/src/lib/cors.ts. Additional context is available in the VulnCheck advisory and the Rybbit issue discussion.

Workarounds

Place Rybbit behind a reverse proxy (for example, Nginx or Caddy) and rewrite Access-Control-Allow-Origin to a static allowlist of trusted domains.
Strip or override Access-Control-Allow-Credentials at the proxy layer for requests originating from untrusted origins until the upgrade is deployed.
Restrict Rybbit administrative interfaces to VPN or IP-allowlisted access so that browser-based cross-origin attacks cannot reach authenticated endpoints.

bash

# Nginx reverse proxy mitigation - allow only trusted origins
map $http_origin $cors_allowed_origin {
    default "";
    "https://analytics.example.com" $http_origin;
    "https://admin.example.com"     $http_origin;
}

server {
    location / {
        proxy_pass http://rybbit_backend;
        proxy_hide_header Access-Control-Allow-Origin;
        proxy_hide_header Access-Control-Allow-Credentials;
        add_header Access-Control-Allow-Origin      $cors_allowed_origin always;
        add_header Access-Control-Allow-Credentials "true" always;
    }
}