cors-misconfig
CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the Origin header in Access-Control-Allow-Origin or set it to with Access-Control-Allow-Credentials: true. Detect via Origin: https://attacker.com reflection in Access-Control-Allow-Origin response header, wildcard on credentialed endpoints, and null origin acceptan…