No CORS header is a valid state
When Access-Control-Allow-Origin is absent, browser same-origin policy remains the default for cross-origin script reads.
Website security
Inspect CORS and cross-origin browser policy.
See whether the response relaxes the browser same-origin policy and which isolation/resource headers are present.
Result
Website security observations
What to review
Read the finding in context.
`*` can be intentional
A wildcard is often appropriate for a genuinely public resource or API. It needs context rather than an automatic red mark.
Credentials change the risk
Credentialed cross-origin access should use intentional origins; wildcard plus credentials is a confused policy that browsers reject.
COOP / COEP / CORP
Cross-origin isolation can be valuable for some applications but can also break legitimate embeds and third-party resources.