diff --git a/packages/core/server/src/helper.ts b/packages/core/server/src/helper.ts
index 382e6a8691a..80219d36541 100644
--- a/packages/core/server/src/helper.ts
+++ b/packages/core/server/src/helper.ts
@@ -41,17 +41,12 @@ export function createResourcer(options: ApplicationOptions) {
 
 function isWhitelistedCorsOrigin(ctx: any) {
   const origin = ctx.get('origin');
-  const whitelist = getCorsWhitelist();
 
   if (!origin) {
     return false;
   }
 
-  if (!whitelist) {
-    return isTrustedOrigin(ctx, origin);
-  }
-
-  return whitelist.has('*') || whitelist.has(origin);
+  return isTrustedOrigin(ctx, origin);
 }
 
 export function resolveCorsOrigin(ctx: any) {
diff --git a/packages/core/utils/src/__tests__/cors.test.ts b/packages/core/utils/src/__tests__/cors.test.ts
index 86e0cf60d79..f019ca80e52 100644
--- a/packages/core/utils/src/__tests__/cors.test.ts
+++ b/packages/core/utils/src/__tests__/cors.test.ts
@@ -48,6 +48,15 @@ describe('cors utils', () => {
     expect(isTrustedOrigin(ctx, 'https://evil.example')).toBe(false);
   });
 
+  it('trusts every origin when CORS_ORIGIN_WHITELIST contains an asterisk', () => {
+    process.env.CORS_ORIGIN_WHITELIST = '*';
+
+    const ctx = createContext({ host: 'example.com' });
+
+    expect(isTrustedOrigin(ctx, 'https://trusted.example')).toBe(true);
+    expect(isTrustedOrigin(ctx, 'https://evil.example')).toBe(true);
+  });
+
   it('resolves forwarded request origins and referer origins', () => {
     const ctx = createContext(
       {
diff --git a/packages/core/utils/src/cors.ts b/packages/core/utils/src/cors.ts
index 5af863ab741..cc24b83f09d 100644
--- a/packages/core/utils/src/cors.ts
+++ b/packages/core/utils/src/cors.ts
@@ -53,5 +53,9 @@ export function isTrustedOrigin(ctx: OriginContext, origin: string) {
   if (isSameOrigin(ctx, origin)) {
     return true;
   }
-  return getCorsWhitelist()?.has(origin) || false;
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has('*') || whitelist.has(origin);
 }