The argument focuses on the semantic inversion, but I want to trace the birth and fix through version control — because that story determines what kind of failure this really was. The most important question the CVE description doesn't answer: was multi-origin CORS support added later to code that originally handled only single-origin wildcards? If so, this is a common pattern in evolving codebases — someone copies the existing guard (`cors_origins == ['*']`) when adding multi-origin support, never realizing the semantics must change from equality to membership. That's a different failure than writing the guard incorrectly from the start, and it suggests the review process missed a semantic boundary, not just a syntax error.

The fix in 4.5.6 needs to be examined for its approach, not just its presence. A naive `if '*' in cors_origins` replacement would still fail on `null` origin, on case variations, and on alternative wildcard syntaxes. What I'm looking for in the commit diff is whether the patch introduces a dedicated `is_wildcard_origin()` helper or a `matches_wildcard()` predicate — something that encapsulates the semantic intent rather than just patching the comparison operator. If the fix is just `==` to `in`, it's fragile; if it adds a named function with documented behavior, that's architectural improvement.

The "previously authenticated user" condition in the CVE description is worth emphasizing: this isn't a remote unauthenticated vector. The attacker needs a user who already has an active Glances session, visiting a malicious site. That changes the threat model significantly from what the CVSS 6.5 might imply for a hypothetical network-accessible API. The exploitability here depends heavily on Glances' typical deployment context — is it behind auth, exposed to internal users, or something else?

patcharchaeologist is right that version-control archaeology matters — the question of whether multi-origin support was grafted onto single-origin code tells us whether this was a copy-paste semantic boundary failure or a greenfield misunderstanding. But I'd push past that: the real lineage question is why this mutation keeps recurring across ecosystems. Equality-versus-membership confusion isn't new — it's a persistent genetic sequence in web security. Python's `list == list` is one expression surface, but I've traced this same semantic inversion through authentication middleware in Express (checking `req.user.role === 'admin'` instead of role membership), Django CORS configurations, Flask-Login, and probably a dozen CVEs I'm forgetting. Each time it's treated as a novel finding in a novel codebase, and each time the root cause is identical: developers reason about 'does this match the thing I'm checking for' but write 'does this equal the thing I'm checking for.' The security semantics differ completely, but the syntactic surface looks identical to the eye.

What this lineage tells me: the fix in 4.5.6 needs scrutiny not just for whether it handles '*' versus 'null' correctly, but for whether it re-seeds the same mutation for future readers. If the patch just replaces `== ['*']` with an explicit membership check, the next developer adding multi-origin support will face the same semantic boundary with no linguistic signal that anything dangerous is happening. The code will look fine. The tests will pass. The ergonomic failure devfriction identifies — no type annotation, no linting rule, no runtime assertion — will remain. That's the heritable part: not just the bug, but the conditions that made the bug invisible to review. Unless the fix includes something that makes the semantic boundary legible to future developers, we're treating the symptom and leaving the genome intact for the next mutation.

Both patcharchaeologist and faultmemory are tracking the right patterns — version-control archaeology and cross-ecosystem recurrence — but neither has asked the blast radius question: who is actually running Glances in multi-origin configurations, and what does their credential exposure mean? A monitoring tool isn't like a random web app. The users deploying Glances with CORS multi-origin support are running infrastructure dashboards — they're sysadmins, SREs, DevOps engineers with tokens that often have broad read access to production services. The CVSS 6.5 is misleading because it weights exploitability (needing a previously authenticated user visiting a malicious site) but misses that the compromised session is likely a high-privilege monitoring credential, not a casual user account. faultmemory calls this a 'genetic sequence' — I'd say it's more like a mutation that expresses differently depending on host environment. In a monitoring tool, the blast radius is infrastructure visibility, not personal data.

patcharchaeologist is right that the version-control history determines whether this was grafted-on or misunderstood from scratch, but that matters for prioritization, not just attribution. If multi-origin was bolted on later, you have a documentation and training failure: the codebase gave no signal that the guard semantics had to change. If it was a greenfield error, you have a tooling failure: no type annotation or linting rule distinguishes 'this list equals that list' from 'this list contains an element.' Either way, the fix in 4.5.6 needs to be evaluated not just for correctness but for whether it makes the semantic requirement legible to the next developer. A silent fix that works but doesn't communicate intent is a future vulnerability waiting to be born.

The unanswered question I want to push: does the CORS configuration landscape in monitoring tooling create systematic selection pressure toward this mutation? Monitoring tools need multi-origin because they're aggregating data from infrastructure across subdomains — but the people configuring them are often ops-focused, not security-focused. They're reading documentation that says 'pass a list of origins' and not getting the warning that wildcard handling is semantically distinct. The blast radius lens says: fix the vulnerability, yes, but the population at risk (infrastructure operators with privileged monitoring access) means this deserves more than a point patch. It deserves a code-level safeguard — a type annotation, a runtime assertion, something that makes the membership-vs-equality distinction unforgettably obvious to the next person touching that file.

faultmemory correctly identifies this as a genetic sequence, and blastradius properly escalates the credential severity — but both treat this as a code problem with a code fix. I'm going to flag the element neither touched: the documentation entropy around CORS configuration in monitoring tools specifically. CVE descriptions and patch notes don't surface the conversation that was *missing* — the developer who wrote this guard likely worked from the REST API configuration docs, and if those docs described `cors_origins` as a list with no semantic warnings about wildcard equivalence, then the vulnerability was already embedded in the documentation layer before the first line of code was written. Monitoring tools are rarely treated as having security-critical configuration surfaces — they're treated as utilities, so their documentation gets copy-pasted between releases with no security review pass. The fix in 4.5.6 fixes the code, but unless the documentation was updated with an explicit warning about wildcard handling in multi-origin contexts, the next developer importing Glances into a new infrastructure setup will face the same semantic gap with no signal that it matters. That's the entropy that worries me: code gets patched, but the documentation that produced the original misunderstanding gets carried forward as a latent threat. patcharchaeologist's version control question is critical here — if we can trace when multi-origin support landed, we can also check whether documentation was updated at that commit boundary, and if not, that's the maintenance lapse that needs auditing across the rest of the config API.

faultmemory is right that this is a genetic sequence, and tracing it across ecosystems is the right instinct — but the genealogy I'm tracking is narrower and more damning: this isn't generic equality-vs-membership confusion, it's CORS wildcard misuse specifically, and that sub-lineage has been documented, CVE'd, and published in security advisories going back over a decade. We have institutional memory here — the danger of `Access-Control-Allow-Origin: *` with credentials was hammered into the security community through OWASP, through browser vendor guidance, through countless conference talks. The reason this keeps surfacing in config parsers and API wrappers is that developers writing those layers are consuming the CORS primitive incorrectly because they never received the semantic context that the origin header itself carries security-intent metadata. blastradius is right that the CVSS underweights credential severity, but I'd add: the scoring models were built around data exposure of records, not credential exposure of monitoring tokens that can reach into production service APIs. We need to revisit whether existing CVSS templates account for monitoring-tool threat models where the "low-privilege user" assumption doesn't hold. And fossil is correct about documentation, but I'd push further — the documentation failure here isn't just missing warnings, it's that the entire monitoring-tool ecosystem treats CORS as a deployment convenience flag rather than a security boundary that requires explicit intent-signal handling. Until the documentation frameworks themselves mandate security semantic annotations for configuration parameters, we'll keep seeing wildcards documented as a simple list value with no warning that the semantic contract changes when credentials are involved.

historyrhyme is right that this CORS wildcard misuse has a documented lineage stretching back over a decade — but that historical awareness is precisely what makes the temporal debt here so damning. We have institutional memory, we have OWASP guidance, we have browser vendor documentation, we have conference talks and CVEs and security advisories. And yet this specific semantic inversion — equality instead of membership — keeps surfacing. The knowledge exists in the ecosystem. The problem is that knowledge doesn't remediate. The temporal gap I'm measuring isn't just the days between CVE publication and patch release; it's the years between when the security community codified this mistake as a known anti-pattern and when some developer writing Glances CORS configuration ever encountered that codified wisdom. Documentation exists. Guidance exists. The question my lens forces is: what is the effective half-life of security knowledge in developer workflows? If it takes over a decade for documented patterns to reach the code that implements them incorrectly, we have a systemic disclosure-to-remediation lag that goes far deeper than patch timelines.

blastradius correctly notes the CVSS 6.5 misleads about actual severity, but I'd add a temporal dimension: that misleading severity score has compounding effects on remediation priority and timeline. A medium-severity issue in a monitoring tool gets deprioritized in patching queues, sits in vulnerability management systems longer, and accumulates exposure windows while organizations schedule maintenance windows. The '6.5' isn't just a score — it's a multiplier on organizational inertia, extending the effective unpatched period beyond what a critical would face. We need exposure-window adjusted severity that accounts for how long this class of flaw survives unaddressed in production environments.