# Cross-origin wildcard trust

Policies trusting wildcards, subdomains, CDNs or localhost origins that others can serve content from

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; latest 2026-09-08. Updated 2026-10-24._

## How it works
A cross-origin policy (crossdomain.xml, `Security.allowDomain`, CORS `allow_origins`) is meant to name the exact origins allowed to read a site's responses. The assumption that breaks is that every trusted origin is actually controlled by the site. When the policy trusts a wildcard, a whole subdomain tree, or a CDN, the real trust boundary becomes the weakest origin in that set. If any trusted origin can be taken over, made to serve attacker content, or is a localhost service any browser can reach, the attacker reads the protected responses as if they were that origin [E2](https://bugbountylibrary.com/r/h1%3A102234.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md)[E4](https://bugbountylibrary.com/r/h1%3A244504.md).

## Where it shows up
- crossdomain.xml with wildcard subdomain entries or `allow-http-request-headers-from domain="*" headers="*"` [E4](https://bugbountylibrary.com/r/h1%3A244504.md)
- CORS `allow_origins=["*"]` on a loopback/localhost API, where the victim's browser is a local client [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md)
- Wildcard ACAO combined with `Access-Control-Allow-Credentials: true` and `Access-Control-Allow-Private-Network: true` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md)
- SWFs on trusted CDNs calling `Security.allowDomain("*")` plus a URL parameter that loads another SWF [E2](https://bugbountylibrary.com/r/h1%3A102234.md)
- Any trusted domain with a dangling subdomain open to takeover [E4](https://bugbountylibrary.com/r/h1%3A244504.md)

## How to review
Enumerate every origin the policy trusts and ask, for each, who can serve content there. The invariant: every trusted origin must be exclusively controlled by the site owner, with no takeover-prone subdomains, no attacker-settable load parameters, and no wildcard. For CORS, wildcard is only safe when the endpoint is truly public and unauthenticated; a loopback bind does not substitute for origin checks, and wildcard plus credentials is never safe [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md). For Flash, confirm trusted CDN SWFs do not combine `allowDomain("*")` with attacker-controlled load parameters [E2](https://bugbountylibrary.com/r/h1%3A102234.md).

## Variants seen
- Wildcard subdomain trust in crossdomain.xml combined with a takeover-vulnerable subdomain [E4](https://bugbountylibrary.com/r/h1%3A244504.md)
- Trusted CDN SWF with `allowDomain("*")` and attacker-controlled SWF URL [E2](https://bugbountylibrary.com/r/h1%3A102234.md)
- Wildcard CORS on a localhost CLI bridge passing dangerous flags through [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md)
- Wildcard CORS with credentials and Private-Network opt-in on an Electron app's localhost API [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md)

## Impact and severity
Cross-origin reads of authenticated content: settings data [E2](https://bugbountylibrary.com/r/h1%3A102234.md), authenticated responses [E4](https://bugbountylibrary.com/r/h1%3A244504.md), and in the localhost cases remote code execution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md). Severity rises with the sensitivity of readable data and when a trusted origin is trivially takeable or reachable by any browser.

## Why fixes fail
Narrowing to a wildcard subdomain still inherits the weakest subdomain's security [E4](https://bugbountylibrary.com/r/h1%3A244504.md); binding to loopback without fixing `allow_origins` leaves the boundary open [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-96p9-rh4f-92cf.md
- E2: https://bugbountylibrary.com/r/h1%3A102234.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-68p4-j234-43mv.md
- E4: https://bugbountylibrary.com/r/h1%3A244504.md