Permissive CORS (wildcard origin)
MediumAV-NET-002NetworkCore pack
What it finds
`Access-Control-Allow-Origin: *`, `cors({ origin: true })`, or `origin: '*'`.
Why it matters
Any website a user visits can silently call this agent on that user's behalf.
How to fix it
Restrict CORS to an explicit allowlist of trusted origins.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- PERMISSIVE_CORS
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Server/API source with CORS configuration
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Webhook without visible signature verificationAV-NET-003 · High
- Server-side request to a caller-controlled URLAV-NET-004 · High
- TLS certificate verification disabledAV-NET-005 · High
- Code reaches the cloud metadata endpointAV-NET-006 · High
- Plaintext HTTP endpointAV-NET-001 · Medium
- Remote MCP server over unencrypted HTTPAV-MCP-110 · Medium