CORS Misconfiguration in Armeria Web Framework by LINE

CVE-2026-121821

What is CVE-2026-121821?

A vulnerability has been discovered in the Armeria web framework, specifically in versions 0.84.0 through 1.42.0, where Cross-Origin Resource Sharing (CORS) policies fail to enforce properly configured path restrictions. This flaw allows an attacker-controlled website to exploit the vulnerability by reading sensitive response data from excluded paths if the targeted victim's browser is sending authentication credentials. This scenario poses significant risks to data confidentiality, particularly for authenticated users accessing potentially malicious sites.

References