# CORS Misconfiguration (CTF challenge)

> The Vault API reflects your Origin into Access-Control-Allow-Origin and sends Access-Control-Allow-Credentials: true — so any cross-origin page can read a logged-in user's private response with their…

Canonical: https://codelivly.com/ctf/challenges/cors-misconfiguration

| | |
|---|---|
| Category | Web Exploitation |
| Difficulty | Medium |
| Points | 800 |
| Estimated time | 35 min |
| Type | Live instance |
| Solves | 45 |
| Author | Codelivly |

The Vault API reflects your Origin into Access-Control-Allow-Origin and sends Access-Control-Allow-Credentials: true — so any cross-origin page can read a logged-in user's private response with their cookies. The flag lives in the admin's authenticated /api/account, which you can't call directly. Get it by simulating an admin visiting your cross-origin exploit page. Your own isolated instance; the flag is unique to you.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)