CORS allows all methods
Access-Control-Allow-Methods includes a wildcard.
Why it matters
A preflight would then allow methods you may not have meant to expose cross-origin.
What to do
List only the methods the API needs, such as GET or POST.
Reference
CORS controls which origins may read responses and must not expose credentialed data broadly.