# Cross-origin credentialed data leak

CORS, JSONP, crossdomain.xml or widget/extension proxies that let another origin read authenticated data

_Area: Web access control and IDOR. Seen in 5 disclosed reports; 2 confirmed bounties: $1,337 and $3,134; latest 2021-01-18. Updated 2026-11-01._

## How it works

A browser enforces the same-origin policy, but several mechanisms deliberately relax it: CORS headers, JSONP callbacks, `crossdomain.xml`, and embedded widgets or extension background scripts that fetch on behalf of a page. Each of these is a trust decision about *which origins* may read a response. The assumption that breaks is "only our own front-end can read this data." When the relaxation is too broad, or the endpoint returns more than the UI needs, any attacker page the victim visits can read the victim's authenticated data — the browser attaches the victim's cookies and the relaxed policy hands the response back to the attacker's origin.

## Where it shows up

- CORS responses with `Access-Control-Allow-Origin` reflecting the request `Origin`, or `*` together with `Allow-Credentials: true`.
- JSONP endpoints (`callback=`, `jsonp_dump`) serving data that also has a privacy or auth gate.
- `crossdomain.xml` with wildcard `allow-access-from domain="*.example.com"` where any subdomain hosts user uploads.
- Embedded players/widgets that inherit the viewer's session and expose data via `postMessage`/JS API.
- Extension background scripts that accept a URL and headers from content scripts and return the response body.
- Profile/account endpoints returning more fields than the UI renders.

## How to review

For every cross-origin relaxation, identify the exact set of origins allowed to read the response and compare it to the set that *should* read it. The invariant: an authenticated response may only be readable by origins the application controls, and only the fields the UI actually uses may be returned. Check that privacy/auth gates apply to the cross-origin path, not just direct requests — a gate that inspects the requester's auth state is bypassed when the browser supplies cookies to a `<script>` or credentialed fetch. For widgets and extensions, ask whether the caller controls the URL, method, headers, or target playlist, and whether the response is returned to that caller.

## How finders spotted it

- Knew YouTube's special playlists (HL, WL, Liked, Uploads) and the embedded player's `postMessage` API separately, then realized the player is authenticated as the viewer, so `getPlaylist()` would return owner-only data [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md).
- Noticed `charts.json.spt` used `jsonp_dump` while the `hide_receiving` check only guarded direct requests, so JSONP inclusion bypasses the 403 [E3](https://bugbountylibrary.com/r/h1%3A361951.md).
- Saw the wildcard `allow-access-from` in `crossdomain.xml` and that user uploads land on `static-*.badoo.com`, a matching subdomain [E4](https://bugbountylibrary.com/r/h1%3A96662.md).
- Read the extension's background-script message handler, saw it accepted arbitrary URL and headers from content scripts, then tested cross-origin credentialed POST with response readback [E5](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-145304705.md).

## Variants seen

- Authenticated embedded widget leaking private data via its JS API/postMessage [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md).
- Misconfigured CORS on an API returning over-broad PII [E2](https://bugbountylibrary.com/r/h1%3A924951.md).
- JSONP callback bypassing an auth-based privacy gate [E3](https://bugbountylibrary.com/r/h1%3A361951.md).
- Wildcard `crossdomain.xml` trusting a subdomain that hosts user content [E4](https://bugbountylibrary.com/r/h1%3A96662.md).
- Extension background script proxying credentialed cross-origin requests for any renderer [E5](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-145304705.md).

## Impact and severity

Leaks ranged from private donation data [E3](https://bugbountylibrary.com/r/h1%3A361951.md) and profile PII [E2](https://bugbountylibrary.com/r/h1%3A924951.md) to watch history, likes and unlisted video IDs [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md), and authenticated data via uploaded Flash [E4](https://bugbountylibrary.com/r/h1%3A96662.md). Impact rose when the leak exposed secrets enabling further access (unlisted video IDs [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)) or when over-returned PII turned a config flaw into a real disclosure [E2](https://bugbountylibrary.com/r/h1%3A924951.md). Extension proxying bypassed Site Isolation, widening reach to any origin [E5](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-145304705.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md
- E2: https://bugbountylibrary.com/r/h1%3A924951.md
- E3: https://bugbountylibrary.com/r/h1%3A361951.md
- E4: https://bugbountylibrary.com/r/h1%3A96662.md
- E5: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-145304705.md