The vulnerability arises from the try_match function, which performs case-insensitive matching for request paths. Since URL paths are case-sensitive, this mismatch allows unauthorized origins to access paths that should be restricted. This misconfiguration undermines the CORS policy, leading to potential data exposure and unauthorized access to sensitive resources.

An attacker can exploit this vulnerability by sending a request to a case-sensitive path with a different case, bypassing the CORS policy. For example, accessing /api/super_Secret with an unauthorized origin like https://notlowercase.com will be allowed due to the case-insensitive matching, exposing sensitive data.

Users and organizations using version 4.01 of the software with CORS configurations that rely on case-sensitive path matching are affected. This includes any web applications that expose sensitive endpoints and rely on CORS for security.