If the server reflects any origin and sends credentials, any website a user visits can read their balance and transactions. That is the CORS risk.
CORS is only dangerous when three things align: the server reflects the attacker's origin, it sends credentials with the response, and the endpoint returns user data. Then any page the user opens can read their authenticated data across origins.
A wildcard without credentials is usually harmless. A reflected origin with credentials on a balance endpoint is a silent data thief. The difference matters, and scanners get it wrong in both directions.
The fix is an allow-list of the exact origins that need access, credentials only where required, and no reflection. But the hard part is knowing every origin that legitimately calls the API — which is exactly the map an assessment produces.
No. Many are benign. We verify each one against a real cross-origin request and report only what actually leaks data.
A crafted page in a browser is the cleanest proof, so yes — we demonstrate the read exactly as an attacker's site would.