Access-control-allow-origin: * and Access-control-allow-credentials:
First and foremost let me tell you what those headers are.The Access-control-allow-origin is a response header sent by a website which tells the browser to relax the same origin policy for the website listed in it.The wildcard * means any origin(domain,subdomain) can send request and receive response.The access-control-allow-credentials is a response header which instructs the browser to send in cookies along with the request.
What would happen if Access-control-allow-origin: * and
Access-control-allow-credentials: true is set?
An attacker could take you to a website and then that website could issue a request to another website with the configuration and read the response.This would pretty much wreak havoc on the internet.
Why website are allowed Access-control-allow-origin: * and
Browsers simply ignores it if Access-control-allow-origin is set to wildcard then the browser wont allow submitting of credentials(cookies) with the request which would render any attack useless since you can't target anyone without their cookies.
Then why do websites send this combination of response headers?
First and foremost for non credentials request, Secondly this could be due to the presence of changing of ACAO with the origin header. If no origin is specified then the response ACAO contains the wildcard. But I have nothing to back up this part of the answer