Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3

CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy.

The AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regular expression matches. For example, an allowed domain of “example.com” will match the Origin header “example.com.malicious.domain”.