A wildcard CORS policy with credentials

Access-Control-Allow-Origin: * on its own is common and often fine for a public API. Combined with Access-Control-Allow-Credentials: true it means "any website may make requests to me using the visitor’s session, and read the response".

Browsers refuse that pairing, but any layer that honours it — a proxy, a gateway, a non-browser client — turns it into account takeover through a header.

Replace the wildcard with an explicit allowlist of the origins your own frontend runs on, and reject everything else. If your API genuinely needs to be callable by anyone, then it must not accept credentials — pick one.