Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25478 CORS Origin Validation Bypass in Litestar ASGI Framework Before 2.20.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25478
Post summary
A CORS origin validation bypass vulnerability was disclosed for Litestar ASGI Framework versions prior to 2.20.0, with details linked on vulmon.
CVE-2026-25478 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from confi… https://www.cve.org/CVERecord?id=CVE-2026-25478
Post summary
The tweet outlines the technical details of CVE‑2026‑25478 in Litestar, noting that the issue exists before v2.20.0 and that upgrading resolves it.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | litestar | litestar | - | - | - |