CVE-2013-1639: Opera Browser

Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request.

Affected products

• Opera Opera Browser: up to and including 12.12; version 12.00 only; version 12.01 only; version 12.02 only; version 12.10 only; version 12.11 only

Published 2013-02-08. Last modified 2026-06-16.