CVE-2026-82287: rybbit-io rybbit advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-08-28).

Weakness: Permissive Cross-domain Security Policy with Untrusted Domains

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and a user must take an action. Impact: confidentiality high, integrity high, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 2 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 5 references on Exploit Observer

Live scores

EPSS: 0.005
low predicted chance of attack
VEDAS: 0.983
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei

Who is affected

Product	Affected	Not affected
rybbit-io rybbit	before 2.7.0	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 2.7.0.

Vendor guidance:

Fix commit (patch)

How to detect it

Nuclei template (active check)

Rybbit - Credentialed CORS Origin Reflection
Rybbit before 2.7.0 registers @fastify/cors globally with an origin callback that always returns true while credentials are enabled, so the backend reflects any request Origin into the Access-Control-Allow-Origin response header and also sends Access-Control-Allow-Credentials: true. The registration is unscoped, so every route under /api is affected, including the unauthenticated GET /api/health check. A web page on any origin can therefore issue credentialed cross-origin requests and read analytics data and account information or perform authenticated state-changing operations as the victim. This template sends a benign GET /api/health with an attacker-controlled Origin and confirms the Origin is reflected together with credentialed access. Fixed in version 2.7.0.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /api/health); it decides using status, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-82287.yaml

Show the template (43 lines)

yaml

id: CVE-2026-82287

info:
  name: "Rybbit - Credentialed CORS Origin Reflection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Rybbit before 2.7.0 registers @fastify/cors globally with an origin callback that always
    returns true while credentials are enabled, so the backend reflects any request Origin into
    the Access-Control-Allow-Origin response header and also sends
    Access-Control-Allow-Credentials: true. The registration is unscoped, so every route under
    /api is affected, including the unauthenticated GET /api/health check. A web page on any
    origin can therefore issue credentialed cross-origin requests and read analytics data and
    account information or perform authenticated state-changing operations as the victim. This
    template sends a benign GET /api/health with an attacker-controlled Origin and confirms the
    Origin is reflected together with credentialed access. Fixed in version 2.7.0.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-82287&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=rybbit&match=exact
  classification:
    cve-id: CVE-2026-82287
    cwe-id: CWE-942
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,rybbit,cors,misconfig
http:
  - method: GET
    path:
      - "{{BaseURL}}/api/health"
    headers:
      Origin: "https://vedas-cors-poc.example"
    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "vedas-cors-poc.example"
          - "Access-Control-Allow-Credentials: true"
        condition: and
      - type: status
        status:
          - 200

CVE-2026-82287.yaml on GitHub

References

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.