The host is installed with Mozilla Firefox before 41.0 or Firefox ESR 38.x before 38.3 and is prone to a CORS preflight protection mechanism bypass vulnerability. A flaw is present in the applications, which fail to properly handle duplicate cache-key generation or retrieval of a value from an incorrect HTTP Access-Control-* response header. Successful exploitation could allow attackers to bypass CORS preflight protection mechanisms.