CORS headers are explicitly configured

Wildcard CORS (Access-Control-Allow-Origin: *) allows any website on the internet to make authenticated API requests using the user's credentials. An attacker's page can silently read your API responses, trigger state-changing calls, and exfiltrate data — all without the user knowing. The impact depends on what your API does: for a read-only public API, wildcard CORS may be intentional; for an API that returns user data or modifies state, it is a critical data exposure. CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) and OWASP A05 (Security Misconfiguration) directly apply. CWE-346 (Origin Validation Error) maps to the failure to validate the requesting origin.

Replace wildcard * CORS with an explicit allowlist of your own domains. Never use * on routes that handle authentication or return user-specific data.

// Next.js API route — src/app/api/example/route.ts
const allowedOrigins = ['https://yoursite.com', 'https://app.yoursite.com']

export async function GET(req: Request) {
  const origin = req.headers.get('origin') ?? ''
  const headers: Record<string, string> = {}
  if (allowedOrigins.includes(origin)) {
    headers['Access-Control-Allow-Origin'] = origin
  }
  return Response.json({ data }, { headers })
}

If your API is genuinely public with no user data, document the intentional wildcard in a comment so auditors can verify it's a conscious decision.