AIKIDO-2026-593910

TL;DR

Glances includes a guard that disables CORS credentials when the configured origin list is the wildcard, intended to prevent credentialed cross-origin access to the REST API. The check compares the origin list to the wildcard using exact list equality instead of a membership test. Any multi-entry cors_origins list that merely contains the wildcard bypasses the guard, while the underlying middleware still treats the wildcard as allow-all and reflects the request origin together with credentials. The fix changes the guard to a membership test so any origin list containing the wildcard disables credentials.