diff --git a/changelog.d/10114.misc b/changelog.d/10114.misc
new file mode 100644
index 0000000000000000000000000000000000000000..808548f7c7b31d52c3eb918c517eef0346ea6f0e
--- /dev/null
+++ b/changelog.d/10114.misc
@@ -0,0 +1 @@
+Drop Origin and Accept from the value of the Access-Control-Allow-Headers response header.
diff --git a/synapse/http/server.py b/synapse/http/server.py
index 845651e606340a6fb928c6f13944299817e817a8..efbc6d5b254192224e1bdc0b7e3f0c26909f8aa0 100644
--- a/synapse/http/server.py
+++ b/synapse/http/server.py
@@ -728,7 +728,7 @@ def set_cors_headers(request: Request):
     )
     request.setHeader(
         b"Access-Control-Allow-Headers",
-        b"Origin, X-Requested-With, Content-Type, Accept, Authorization, Date",
+        b"X-Requested-With, Content-Type, Authorization, Date",
     )