CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
Misconfigured CDN headers allowed cross-origin credential theft and CSRF bypass, enabling attackers to steal user tokens and data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-90882?
CVE-2026-90882 is a high-severity vulnerability in Eclipse Foundation open-vsx.org, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's browser and read the responses.
This exposed /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name} and /user/namespace/{name}/members, and — because /user/csrf was readable the same way — allowed the CSRF protection on write endpoints to be defeated. Chaining the two, an attacker page could call /user/token/create and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces.
The headers were emitted by the CDN/edge layer, not by the application: the Open VSX software sets allowCredentials(true) in exactly one place, against a single exact origin derived from ovsx.webui.url, and defines no CORS mapping on /user/ beyond it. No configuration of the software produces origin reflection with credentials.
Weakness: CWE-942
Which versions are affected by CVE-2026-90882?
How do I fix CVE-2026-90882?
No fix has been published for CVE-2026-90882 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90882 being exploited?
There is no known exploitation of CVE-2026-90882 in the wild and no public exploit code.
Sources
Also known as GHSA-px7g-fw3g-w264.