Acme Account (CORS)

web · medium · 200 pts

Acme's /api/me reflects Origin and allows credentials. Steal the admin's flag. --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up cors-misconfig ``` Then open `http://localhost:8000` and start solving.