Do you know of any such node that doesn't check the Content-Type of requests and also has no authentication?

Bitcoin Core if you disable authentication

There's no such thing, short of forking it yourself. You can set the username and password to admin:admin if you want, but Bitcoin Core's JSON-RPC server requires an Authorization header on every request [0], and you can't put an Authorization header on a cross-origin request without a preflight.

[0] https://github.com/bitcoin/bitcoin/blob/v29.0/src/httprpc.cp...

Good to know, I remember you used to be able to disable it via config but looks like I was wrong