Many modern websites use CORS to allow access from subdomains and trusted third parties. Their implementation of CORS may contain mistakes or be overly lenient to ensure that everything works, and this can result in exploitable vulnerabilities.
{% embed url="https://securityonline.info/of-cors-identifying-and-exploiting-cors-misconfigurations/" %}
{% embed url="https://portswigger.net/web-security/cors" %}