# Permissive cross-domain policy on auth endpoints

Wildcard or user-content origins trusted with credentials on login, token, or OAuth endpoints

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; latest 2026-10-09. Updated 2026-10-23._

## How it works

A cross-domain policy (CORS or Flash `crossdomain.xml`) tells the browser which other origins may make credentialed requests and read the responses. The broken assumption is that the allowlist only names origins the site controls. When the list includes a wildcard, a localhost pattern, or a domain that hosts user-uploaded content, any page on that origin can send the victim's cookies or tokens to the auth endpoints and read the reply. The trust boundary the policy was meant to draw collapses.

## Where it shows up

- CORS config with `AllowCredentials: true` combined with wildcard or `localhost:*` / `127.0.0.1:*` origins.
- A "required" public-URL setting that is *appended* to default origins instead of replacing them, so production keeps trusting localhost [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md).
- `crossdomain.xml` / `clientaccesspolicy.xml` listing `*`, or domains that host user-injectable Flash/SWF content (e.g. `*.yahoo.com`, `*.yimg.com`) [E2](https://bugbountylibrary.com/r/h1%3A176308.md).
- A wildcard policy file in a parent directory, inherited by sensitive child paths like `/oauth/authorize` [E3](https://bugbountylibrary.com/r/h1%3A136582.md).
- Token-refresh or cookie-for-bearer endpoints that return a bearer token in the response body.

## How to review

Check the exact invariant: every origin trusted with credentials must be one the site fully controls, and no wildcard, localhost pattern, or user-content host may appear. Trace how config defaults merge with deployment settings — confirm the public URL *replaces* defaults, not extends them [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md). For policy files, resolve inheritance: a wildcard in a parent directory covers all children [E3](https://bugbountylibrary.com/r/h1%3A136582.md). For each credentialed endpoint, ask whether its response body contains a secret (token, OAuth code) that a cross-origin reader could exfiltrate.

## Variants seen

- Default CORS origins trusting all localhost ports, plus a refresh endpoint returning a bearer token [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md).
- `crossdomain.xml` trusting domains that host user-uploaded SWF, enabling credentialed reads of the OAuth flow [E2](https://bugbountylibrary.com/r/h1%3A176308.md).
- Wildcard `crossdomain.xml` in a parent directory inherited by the OAuth authorize endpoint [E3](https://bugbountylibrary.com/r/h1%3A136582.md).

## Impact and severity

All three led to full account or app authorization takeover without user approval [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md)[E2](https://bugbountylibrary.com/r/h1%3A176308.md)[E3](https://bugbountylibrary.com/r/h1%3A136582.md). Severity is high because the primitive is a credentialed cross-origin read of auth secrets. It worsens when the trusted origin hosts attacker-controllable content and when the endpoint returns tokens in the body rather than requiring a second check.

## Why fixes fail

Appending the public URL to defaults instead of replacing them leaves localhost trust in place after configuration [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md); a fix must reset the list, not add to it.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-m687-p538-r5hp.md
- E2: https://bugbountylibrary.com/r/h1%3A176308.md
- E3: https://bugbountylibrary.com/r/h1%3A136582.md