The open‑vsx.org service incorrectly reflected the requesting origin and included the Access‑Control‑Allow‑Credentials header on authenticated /user endpoints. This allowed a page from any origin to perform credentialed requests in a logged‑in user’s browser and read sensitive data such as login name, avatar, homepage, tokens URL, user namespaces, extensions, and search results. The same misconfiguration also let the attacker defeat CSRF protection on write endpoints; by chaining the read and write paths an attacker could trigger /user/token/create and exfiltrate a personal access token with publish and delete rights. The flaw is identified as CWE‑942, a weakness in origin‑based access controls.

The affected product is the Open VSX platform hosted at open‑vsx.org, maintained by the Eclipse Foundation. The vulnerability resides in the CDN or edge layer that emits the reflected headers and is not controlled by application configuration. Specific version information is not provided in the advisory, so the scope applies to all current deployments of the Open VSX service that rely on the default edge configuration.

The CVSS score of 8.7 indicates high severity, and the exploit is likely to be simple for any user who can load a malicious page in a victim’s browser. Although the EPSS score is not available, the lack of a KEV listing does not negate the risk; the vulnerability would be trivial to exploit once a user visits a malicious origin. An attacker only needs to host a small page that issues cross‑origin requests; no additional privileges or network access are required. The ease of exploitation and the potential to generate tokens with broad scopes mean that the risk for an impacted organization is significant.