Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.

Rybbit versions before 2.7.0 contain a critical CORS misconfiguration vulnerability tracked as CVE-2026-82287. The flaw causes the server to reflect any incoming request origin in the Access-Control-Allow-Origin response header while simultaneously allowing credentials, effectively nullifying origin-based access controls. Attackers can exploit this by hosting malicious web pages that issue credentialed cross-origin requests to Rybbit instances on behalf of authenticated victims. Successful exploitation enables unauthorized access to analytics data and account information, as well as the ability to perform authenticated state-changing operations as the victim user. The vulnerability exists in the server-side CORS configuration found in the index.ts file. A fix was introduced in version 2.7.0 via a specific commit to the repository. The issue was publicly disclosed through a GitHub issue and detailed in a VulnCheck advisory. Users are strongly advised to upgrade to Rybbit 2.7.0 or later to remediate the vulnerability.