CWE-942

Cursor, Bolt, Lovable, and GitHub Copilot AI coding assistants frequently generate CORS middleware that reflects the incoming Origin header with credentials enabled, creating a critical vulnerability …

A developer discovered that the AI code editor Cursor fixed a CORS error in their side project by generating middleware that uses origin reflection, a pattern that echoes back any Origin header sent b…