An error in Fiber’s CORS middleware caused wildcard subdomains to be interpreted without a dot boundary, allowing an attacker-controlled origin whose host ends with the allowed base domain to be accepted as a valid origin. When the application’s AllowCredentials flag is enabled, this permits an attacker’s page to read authenticated responses from the victim’s site, exposing user session data. The weakness is identified as CWE-346 (Untrusted Content Source) and CWE-942 (Passage of credentials through CORS wildcard origins).

The vulnerability affects the GoFiber web framework, specifically versions 2.52.1 through 2.52.3 inclusive. Any applications built with Fiber in that range and configured with wildcard AllowOrigins and AllowCredentials are impacted.

The CVSS score of 5.9 indicates medium severity, and no EPSS score is available, suggesting limited current exploitation data. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to host a webpage with a crafted origin matching the victim’s domain suffix; the attack is remote and does not require local code execution.