We recently got an API for security audit. The CORS headers of the API seems mis-configured as when we tried requesting the endpoint with
http://attacker.com as origin the server returned the following in the response headers:
access-control-allow-credentials: true access-control-allow-methods: GET, POST, DELETE, PUT access-control-allow-origin: http://attacker.com
Though the site is vulnerable, but the problem which is blocking us from creating an exploit impact is that the site send an authorization token in each request, which is unique for each user. Any ideas on how to go ahead in a situation like this?