CORS allows any origin with credentials
Access-Control-Allow-Origin is * and Access-Control-Allow-Credentials is true.
Why it matters
That combination tells browsers every site may read the response with credentials. Browsers reject the invalid pair, but the server configuration is still wrong.
What to do
Reflect an allowlisted origin instead of *, and only set Allow-Credentials for origins you trust.
Reference
CORS controls which origins may read responses and must not expose credentialed data broadly.