CORS Access-Control-Allow-Origin: * with Allow-Credentials: true

CORS (Cross-Origin Resource Sharing) is the browser rule set that controls which websites are allowed to make requests to your server and read the response. This check looks for a specific, well-known misconfiguration: the server allowing any website at all, a wildcard, written as *, while also allowing those requests to include the visitor's login cookies. On this site, both settings were found together. This combination would let any website on the internet make requests to this server using a logged-in visitor's own session and read the response back, effectively letting a malicious site impersonate the visitor. Modern browsers actually block this specific combination as a safety net, but its presence still shows a serious misconfiguration in how the server is set up, and it means the underlying access rules are wrong even where the browser happens to catch it. Your developer should replace the wildcard with an explicit list of trusted origins that are actually allowed to make credentialed requests, and never combine a wildcard origin with Allow-Credentials: true. This is a server configuration change, roughly 30 minutes, and should be treated as urgent since other tools, like curl, server-to-server clients, and automated agents that aren't browsers, will honour the misconfiguration even though browsers block it.