Reflecting any origin

Whatever origin you claim

Send a request pretending to come from an attacker's site and watch the response headers:

curl -s -i -H 'Origin: https://evil.example' http://127.0.0.1:8080/api/account | grep -i access-control

In the terminal

student@vulntech:~$ curl -s -i -H 'Origin: https://evil.example' http://127.0.0.1:8080/api/account | grep -i access-control
Access-Control-Allow-Origin: https://evil.example
Access-Control-Allow-Credentials: true

The server set Access-Control-Allow-Origin: https://evil.example and Access-Control-Allow-Credentials: true — it reflected whatever origin asked and said credentials are welcome. That combination means a logged-in victim who visits evil.example has their account JSON read and stolen by that page.