The Litestar ASGI framework is vulnerable to a cross-origin security bypass that allows unauthorized domains to circumvent CORS restrictions due to insufficient regex escaping.

This vulnerability involves a permissive cross-domain policy (CWE-942) where the allowed_origins_regex configuration fails to escape metacharacters. This allows an unauthenticated remote attacker to craft a malicious origin that unexpectedly matches the validation logic, potentially bypassing intended CORS protections.

The exploitation of this vulnerability could lead to unauthorized cross-origin resource access, potentially exposing sensitive application data to malicious third-party domains. While the CVSS score of 7.4 reflects a high severity, the impact is primarily focused on the confidentiality of resources protected by CORS policies rather than direct system compromise.

Immediate Action: Update the Litestar package to version 2.20.0 or later to ensure the regex validation logic correctly handles origin strings.

Proactive Monitoring: Review application logs for unexpected cross-origin requests or suspicious headers that deviate from standard traffic patterns for your API endpoints.

Compensating Controls: Implement a strict Web Application Firewall (WAF) policy that validates the Origin header against a hard-coded allowlist, though this should be considered a temporary measure until the framework is updated.

Public Exploit Available: Unknown

Given the potential for unauthorized data exposure and the availability of a vendor-supplied patch, administrators should prioritize updating their Litestar dependencies immediately. Testing the update in a staging environment is advised to ensure that the tightened regex validation does not adversely impact existing legitimate cross-origin communication.