Corydolphin Flask-CORS Case-Insensitive Path Matching Vulnerability Allowing Unauthorized Access

A vulnerability exists in Corydolphin Flask-CORS version 4.01, where request path matching is improperly handled due to case insensitivity. This issue arises from the use of the 'try_match' function, which is designed for host matching but inadvertently applies to paths, leading to a security flaw. URLs are case-sensitive, and this misconfiguration can allow unauthorized origins to access restricted paths, potentially causing data exposure and leaks.

Impact

Exploitation of this vulnerability could result in unauthorized access to restricted paths, allowing for data exposure and potential data leaks.