The Sanic‑Cors library, specifically versions 2.2.0 and earlier, contains an improper regular expression in the try_match() function. The regex uses re.match without an end‑anchor, allowing a string that starts with a trusted origin to be considered a match. An attacker can craft a domain name that begins with an approved origin string, thereby bypassing the CORS origin allowlist and gaining unauthorized access to cross‑origin requests for resources that require authentication. This vulnerability is a form of improper authorization, first identified as CWE‑285.

All deployments that use Sanic‑Cors library version 2.2.0 or older. The library is typically employed in Sanic web applications that implement CORS handling. Any application that relies on the default CORS allowlist mechanism of Sanic‑Cors falls within the affected scope.

The vulnerability actively compromises the integrity of CORS policies, permitting an attacker to impersonate a trusted origin. While no EPSS score is available and the vulnerability is not listed in CISA KEV, the absence of end‑anchoring in the regex makes it straightforward for an attacker who can register or introduce a domain prefixed by an allowed origin. No additional prerequisites are required beyond the ability to submit a domain that begins with a whitelisted origin. The CVSS score is not provided, but the attack surface is significant and exploitable in typical deployment scenarios.