CORS MISCONFIGURATION

ACCESS-CONTROL-ALLOW-ORIGIN: *

API reflects Origin header or uses wildcard ACAO with credentials allowed. Malicious origin reads authenticated API responses cross-origin.

[ SIMULATED API RESPONSE ]

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://evil.com
Access-Control-Allow-Credentials: true
Content-Type: application/json

{"user":"admin","api_key":"sk-secret-12345","balance":50000}

[*] Misconfigured API allows evil.com to read sensitive JSON...