A CORS misconfiguration in the local API server of Jan reflects user‑specified origins with credentials, enabling the server to replace configured trusted hosts with a wildcard. This flaw allows attackers to access the unauthenticated OpenAI‑compatible API endpoints and to perform inference tasks, enumerate available models, invoke MCP tools, and read cross‑origin responses that would normally be restricted.

The vulnerability is present in Jan versions up to and including 0.8.4. The official fix is included in commit 3e1c1e7 which restores proper trusted host handling. Users should verify the installed version and apply the update if they are running a vulnerable release.

The CVSS score is 5.3, indicating a moderate impact level. The EPSS score is listed as less than 1%, suggesting a very low probability of exploitation in the near term. The flaw is not listed in CISA’s KEV catalog. Attackers would need to be on the local network or use DNS rebinding techniques to reach the local API server. Once they succeed, they can perform unauthorized API calls with credential leakage, enabling misuse of the proprietary model service.