Two response headers, set together, undo one of the browser's core protections:

Access-Control-Allow-Origin: <reflected attacker origin>
Access-Control-Allow-Credentials: true

Reflecting whatever Origin the request carried, with credentials allowed, means any website can make authenticated requests as the victim and read the responses. The Same-Origin Policy is effectively off.

Why it is worse on an auth endpoint

On a banking OAuth gateway we tested, this misconfiguration sat on the Pushed Authorization Request (PAR) endpoint. An attacker page could silently issue a credentialed request, read back the victim's OAuth request_uri, and replay it at the authorize endpoint to log in as the victim — a complete corporate Account Takeover. Details and PoC: the CORS account-takeover write-up.

The rule

Never reflect Origin into Access-Control-Allow-Origin. Use a strict allowlist of first-party origins, and never pair a reflected/wildcard origin with Access-Control-Allow-Credentials: true. Auth responses in particular must not be cross-origin readable.