Cross-origin response disclosure via prefix-matched origins

Origin validation in Sanic-CORS 2.2.0 and earlier allows remote attackers to read authenticated cross-origin responses via a crafted domain. The try_match() function in sanic_cors/core.py passes configured origin patterns and the request Origin value to re.match(), which accepts a trusted-origin prefix without requiring the match to consume the entire value. Exploitation requires control of a prefix-matching domain and user interaction with an attacker-controlled page; the bypass exposes response data but does not directly alter data or interrupt service.