the result is that every origin on the internet is

CORS Misconfigurations That Silently Expose Your API to Any Origin

A misconfigured CORS policy can let any website silently read your API responses on behalf of your users. Learn the exact patterns that create this exposure and how to fix each one before they become a breach.