CVE-2026-25478: Litestar CORS origin allowlist bypass via unescaped regex metacharacters

CVE-2026-25478 · Severity: low · CVSS 3.1 · Published 2026-02-09

Litestar is a Python web framework that uses CORS (Cross-Origin Resource Sharing) configuration to control which external websites can access sensitive data from authenticated user sessions. The CORS origin allowlist validation fails to properly escape regex metacharacters, allowing an attacker to craft a malicious origin domain that matches the allowlist policy unexpectedly. If a site is configured to trust "https://good.example", an attacker can craft "https://goodXexample" (where X matches any character due to unescaped dot metacharacter) and bypass the policy, potentially reading sensitive data from victim browsers in authenticated sessions.

Technologies: litestar (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-25478 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25478 being exploited in the wild.
How severe is CVE-2026-25478?
Low severity, with a CVSS score of 3.1, published 9 February 2026.
Which products and versions are affected?
litestar (PyPI) ECOSYSTEM:introduced=0,fixed=2.20.0, ECOSYSTEM:introduced=2.19.0,fixed=2.20.0.
Is there a fix for CVE-2026-25478?
Yes. litestar (PyPI): upgrade to 2.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25478 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-25478?
Check whether you run litestar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • litestar (PyPI): upgrade to 2.20.0 or later
    pip install "litestar>=2.20.0"

Technical details

The vulnerability exists in Litestar's CORSConfig.allowed_origins_regex implementation, which constructs a regex pattern from user-configured allowlist values without escaping metacharacters (particularly the dot character). When the origin validation check uses regex fullmatch() against untrusted Origin headers, metacharacters in the allowlist are interpreted as regex patterns rather than literal characters. For example, "https://good.example" with an unescaped dot allows matching "https://goodXexample" where X is any character. An attacker can register or control a domain matching this regex pattern, bypass the CORS policy, and read cross-origin responses in a victim's authenticated browser session if allow_credentials=True. The vulnerability was introduced in version 2.19.0 and fixed in version 2.20.0 by properly escaping metacharacters in the regex construction.

Affected products

  • Litestar Litestar 2.19.0 before 2.20.0

Identifiers

  • CVE-2026-25478
  • GHSA-2p2x-hpg8-cqp2
  • PYSEC-2026-2195

Timeline

  • 2026-02-09: disclosed: GHSA-2p2x-hpg8-cqp2 published
  • 2026-02-09: patched: Fix released in version 2.20.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.