CVE-2026-25478
📋 TL;DR
Litestar ASGI framework versions before 2.20.0 have a CORS origin validation bypass vulnerability. Attackers can craft malicious origin headers that match the allowed_origins_regex pattern due to improper escaping of metacharacters. This affects any Litestar application using CORSConfig.allowed_origins_regex for origin validation.
💻 Affected Systems
- Litestar ASGI framework
📦 What is this software?
Litestar by Litestar
⚠️ Risk & Real-World Impact
Worst Case
Complete CORS bypass allowing cross-origin requests from unauthorized domains, potentially leading to data theft, CSRF attacks, or unauthorized API access.
Likely Case
Partial CORS bypass enabling attackers to make cross-origin requests from carefully crafted malicious domains that match the regex pattern.
If Mitigated
Limited impact if additional origin validation layers exist or if CORS is not critical to application security.
🎯 Exploit Status
Exploitation requires understanding of regex patterns and ability to craft malicious origin headers. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.20.0
Vendor Advisory: https://github.com/litestar-org/litestar/security/advisories/GHSA-2p2x-hpg8-cqp2
Restart Required: Yes
Instructions:
1. Update Litestar to version 2.20.0 or later using pip: pip install --upgrade litestar>=2.20.0
2. Restart your application server
3. Verify the update with: pip show litestar
🔧 Temporary Workarounds
Switch to allowed_origins list
allReplace CORSConfig.allowed_origins_regex with allowed_origins list which uses exact string matching
Change configuration from: allowed_origins_regex=["regex_pattern"] to: allowed_origins=["exact.domain.com"]
Implement custom origin validation middleware
allAdd additional origin validation layer before Litestar's CORS middleware
Create custom ASGI middleware that validates origin headers against a whitelist before passing to Litestar
🧯 If You Can't Patch
- Implement reverse proxy with strict origin validation
- Use WAF rules to block suspicious origin headers
🔍 How to Verify
Check if Vulnerable:
Check if using Litestar <2.20.0 AND using CORSConfig.allowed_origins_regex in configurationCheck Version:
pip show litestar | grep VersionVerify Fix Applied:
Verify Litestar version is >=2.20.0 and test CORS validation with various origin headers📡 Detection & Monitoring
Log Indicators:
- Unexpected origin headers in CORS preflight requests
- Failed CORS validation logs showing regex pattern mismatches
Network Indicators:
- CORS preflight requests with unusual origin patterns
- Cross-origin requests from unexpected domains
SIEM Query:
web_logs origin="*regex*" AND status=200 AND method=OPTIONS