CVE-2026-25478 Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
Attackers can bypass CORS restrictions in Litestar by exploiting unescaped regex metacharacters in allowed origins, requiring specific configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25478?
CVE-2026-25478 is a high-severity vulnerability in litestar-org litestar, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
Weakness: CWE-942
Which versions are affected by CVE-2026-25478?
3 open source packages ship an affected version, including litestar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
litestar PyPI | All versions | 2.20.0 |
litestar PyPI | From 2.19.0 | 2.20.0 |
litestar PyPI | From 2.19.0 | 2.20.0 |
Products include Litestar Litestar.
How do I fix CVE-2026-25478?
Upgrade litestar to 2.20.0 or later.
Is CVE-2026-25478 being exploited?
There is no known exploitation of CVE-2026-25478 in the wild and no public exploit code.
Other vulnerabilities in litestar-org litestar
- CVE-2024-52581 Litestar allows unbounded resource consumption (DoS vulnerability)
- CVE-2026-25479 Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
- CVE-2026-25480 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Sources
Also known as GHSA-2p2x-hpg8-cqp2, PYSEC-2026-2195.