CORS reflects an untrusted Origin
The response copied the scanner's Origin, https://security-check.invalid, into Access-Control-Allow-Origin.
Why it matters
Any website can send its own Origin and be echoed back, so any site can read the response. If credentials are allowed, that includes credentialed data.
What to do
Allowlist trusted origins. Do not reflect the request Origin, and do not combine a reflected origin with Allow-Credentials: true.
Reference
CORS controls which origins may read responses and must not expose credentialed data broadly.