CVE-2026-121821
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 06, 2026
Vendor
unknown
Description
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.