Is Access-Control-Allow-Origin: * always a vulnerability?
CORS controls whether browser scripts can read cross-origin responses. Public headers can reveal configuration, but proving a credentialed data-exposure issue requires an authorized, contextual assessment.
What the engine observes
- Observed Access-Control-Allow-Origin
- Observed Access-Control-Allow-Credentials
- Potentially inconsistent public header combinations
The free check does not manipulate Origin headers, log in, enumerate APIs or claim to prove an authorization bypass.
What happens after a check?
Read the observations and their evidence first. Save the private report if useful. To go deeper, verify domain control and agree a precise scope, testing window and resource limits. High-impact candidates remain candidates until appropriate validation is complete.
Read verification policy ↗Related checks
Website security checker ↗Security headers checker ↗SSL & TLS checker ↗Content Security Policy checker ↗Cookie security checker ↗Website vulnerability assessment ↗