Description
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.
INFO
Published Date :
2025-10-16T16:29:35.246Z
Last Modified :
2025-10-16T18:13:08.618Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-53092 vulnerability.
| Vendors | Products |
|---|---|
| Strapi |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-53092.
