I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-Control-Allow-Credentials header value is set to true. API contains sensitive data and requires authentication.
If this was a browser application, a malicious app could access to user's sensitive data but I could not think of a way to achieve this from a mobile device.
Is there a way to exploit this configuration from an Android or iOS app or is CORS only relevant for browsers?