sibikrish001/cve-2025-55462Technical documentation and proof-of-concept for CVE-2025-55462, a CORS misconfiguration in Eramba v3.26.0 allowing cross-origin authentication requests on the /system-api/login endpoint.
A Cross-Origin Resource Sharing (CORS) misconfiguration was identified in Eramba Community and Enterprise Editions v3.26.0. The application reflects attacker-controlled Origin headers in the Access-Control-Allow-Origin response header on the /system-api/login endpoint while also setting Access-Control-Allow-Credentials: true.
This configuration allows cross-origin authentication requests to be issued and the corresponding responses to be read by a remote origin when valid credentials are supplied. Standard session-based attacks relying on existing authentication cookies are constrained by browser SameSite protections.
The primary risk is limited to attackers pivoting through a user’s browser to authenticate against internally accessible Eramba instances.
/system-api/loginAn attacker hosts a malicious webpage that issues a cross-origin authentication request to the /system-api/login endpoint with credentials: include. Due to improper CORS validation, the browser allows the response to be read by the attacker-controlled origin when valid credentials are supplied.
Session-based attacks using existing cookies are mitigated by browser SameSite protections.
The vendor confirmed the issue was resolved by strengthening CORS configuration and origin validation.
Discovered and responsibly disclosed by:
Sibi K
Security Researcher