The vulnerability arises from a CORS misconfiguration in Rybbit that reflects any request origin in the Access‑Control‑Allow‑Origin header while Allow‑Credentials is enabled. This flaw permits an attacker to send cross‑origin requests from an arbitrary website with the victim's credentials and read the response. As a result, the attacker can exfiltrate analytics data, victim account information, and perform authorized state‑changing operations on behalf of the user. This issue falls under CWE‑942, which describes header injection with undesirable effects.

The vulnerability affects Rybbit versions older than 2.7.0, available from rybbit‑io. Any installation of the open‑source platform prior to that release is susceptible.

The CVSS score of 8.6 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, indicating no known active exploitation. However, the flaw can be triggered simply by hosting a malicious webpage that issues a fetch or XMLHttpRequest to the Rybbit server with credentials. Because the server echoes back the victim's origin, the attack can succeed even when the victim is browsing any unrelated site, as long as they remain authenticated to Rybbit. Therefore, the risk is high for authenticated users and is likely to be exploited if the attacker gains a foothold in a corporate network or social engineering victim.