Armeria, a Java network library, released versions 0.84.0 through 1.42.0 with a flaw where any‑origin CORS policies ignore configured path restrictions. An attacker who controls a website can trick an authenticated victim into visiting that site. The victim’s browser automatically sends stored credentials to the Armeria server, and because the CORS enforcement does not limit which paths may be accessed from external origins, the attacker can read the server’s responses from excluded paths and obtain sensitive data that should have been protected.

Vendors and systems using LY Corporation Armeria in any of the affected releases – from 0.84.0 up to and including 1.42.0 – are impacted. The vulnerability applies to all deployments that rely on the default CORS configuration or have not overridden the path restriction logic. No specific operating system or platform limitations are mentioned, so any environment running the affected library versions is vulnerable.

The CVSS base score is 5.3, indicating moderate severity. No EPSS score is available, and the advisory is not listed in the CISA KEV catalog, suggesting it is not currently known to be exploited in the wild. Attackers must lure victims to a malicious origin while the victim is authenticated against the Armeria application; the browser sends credentials automatically, allowing the attacker to read cross‑origin responses. Because the flaw relies on trusted user credentials rather than on malicious code on the server, exploitation is less likely than for a traditional remote code execution flaw but can still yield confidential data. Administrators should treat this as a moderate but non‑critical risk that warrants timely patching.