The flaw lies in the CORS middleware of the Hono web framework. When credentials are enabled and no origin is specified, the middleware echoes the request’s Origin header and returns Access‑Control‑Allow‑Credentials: true. This behavior allows any third‑party origin to send authenticated browser requests to cookie‑based endpoints and read the returned data, effectively exposing privileged user content to arbitrary origins. The flaw corresponds to CWE‑942, which represents improper input validation in a cross‑origin communications context.

The vulnerability affects the Hono web framework, with all releases prior to 4.12.25 susceptible. The product is identified as honojs:hono and all versions before 4.12.25 are impacted.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers can remotely exploit the weakness from any webpage by enabling credentials in fetch or XMLHttpRequest without an explicit origin, resulting in credentialed cross‑origin requests that read cookie‑authenticated responses. The attack requires only a malicious site and no privileged access, making exploitation trivial for attackers and posing a significant risk to end users whose browsers send credentials to the vulnerable Hono service.