Vibe Security Radar

Back to Vulnerabilities

CVE-2026-30924

Mar 19, 2026CWE-942

Go

Verified by gpt-5.4-high

Severity

CRITICAL9.0

Verdict

CONFIRMED

0.8 confidence

AI Tool

Claude Code

Language

Go

qui CORS Misconfiguration: Arbitrary Origins Trusted

How AI Introduced This

Yes. The AI-assisted commit f01101d6f24b0c5f4a15b858d87ecd1d7c4ab5e8 did not author the unsafe `AllowOriginFunc(...){ return true }` CORS policy, but it added the auth-disabled / reverse-proxy deployment mode without any accompanying CORS restriction, expanding the impact of the pre-existing arbitrary-origin trust for proxy-authenticated deployments. The original CORS bug itself was introduced earlier by human-authored commits.

▶Attribution Chain

Advisory

GitHub Advisory

Fix Commit

424f7a0— autobrr/qui

git blame

cmd/qui/main.go

Squash Merge

f01101d— 5 sub-commits

PR Decomposition

File overlap + AI signal analysis

Bug-Introducing Commit

▶Bug-Introducing Commits(1)

feat: add option to disable built-in authentication

libussaFeb 18, 2026cmd/qui/main.goBlame: 90%

Extracted from squash merge f01101d

▶4 other sub-commits in this PR

fix(auth): require CIDR allowlist for auth-disabled mode

fix(auth): rename disable-auth acknowledgement flag

fix(auth): enforce safe auth-disabled reload and CIDR validation

fix(config): split auth CIDRs from env and tighten tests

Deep Verification

by investigator-override

CONFIRMED0.8

0 tool calls

80%

Yes. The AI-assisted commit f01101d6f24b0c5f4a15b858d87ecd1d7c4ab5e8 did not author the unsafe `AllowOriginFunc(...){ return true }` CORS policy, but it added the auth-disabled / reverse-proxy deployment mode without any accompanying CORS restriction, expanding the impact of the pre-existing arbitrary-origin trust for proxy-authenticated deployments. The original CORS bug itself was introduced earlier by human-authored commits.

▶AI Signals(1)

Claude Code Co-author trailer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> 95%

▶Fix Commits(1)

424f7a0 autobrr/quiGitHub Advisory

▶References(3)