CVE-2026-82287

CVE-2026-82287 is a permissive cross-origin resource sharing (CORS) misconfiguration (CWE-942) in Rybbit, an open-source web analytics platform, affecting versions before 2.7.0: the application reflects any request Origin in the Access-Control-Allow-Origin response header while credentials are enabled. As a result, any website a logged-in Rybbit user visits can send credentialed cross-origin requests on the user's behalf, because the browser automatically attaches the victim's session credentials and the attacker's JavaScript can read the responses. This allows an attacker to read the victim's analytics data and account information and to perform authenticated state-changing operations as that user, without ever possessing the credentials. All Rybbit deployments running any version earlier than 2.7.0 are affected; the attack is passive for the victim, who only needs to visit an attacker-controlled page while logged in to a Rybbit instance. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.3% probability of exploitation within 30 days, although the flaw is rated 8.6 (High) in CVSS v4.0.

What to do: Upgrade to Rybbit 2.7.0 or later, which corrects the CORS handling. If immediate patching is not possible, replace the origin-reflection behavior with a fixed allowlist of trusted origins and ensure credentialed cross-origin access is restricted to those origins. Review access logs for unexpected cross-origin API calls, since any website a logged-in user visits can currently read their analytics and account data and trigger authenticated state changes.