diff --git a/crates/cli/src/commands/cors.rs b/crates/cli/src/commands/cors.rs
index 06dda15..f2b18f6 100644
--- a/crates/cli/src/commands/cors.rs
+++ b/crates/cli/src/commands/cors.rs
@@ -591,6 +591,38 @@ mod tests {
         assert!(error.contains("unsupported method"));
     }
 
+    #[test]
+    fn test_parse_cors_configuration_xml_rejects_missing_allowed_origin() {
+        let error = parse_cors_configuration(
+            r#"
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedMethod>GET</AllowedMethod>
+  </CORSRule>
+</CORSConfiguration>
+"#,
+        )
+        .expect_err("missing xml allowed origin");
+
+        assert!(error.contains("at least one allowed origin"));
+    }
+
+    #[test]
+    fn test_parse_cors_configuration_xml_rejects_missing_allowed_method() {
+        let error = parse_cors_configuration(
+            r#"
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>https://console.example.com</AllowedOrigin>
+  </CORSRule>
+</CORSConfiguration>
+"#,
+        )
+        .expect_err("missing xml allowed method");
+
+        assert!(error.contains("at least one allowed method"));
+    }
+
     #[test]
     fn test_parse_cors_configuration_rejects_empty_allowed_origin() {
         let error = parse_cors_configuration(