CVE-2026-120627

Full vulnerability record from the local CVENow database.

Description

The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-02 18:18:52.733000

Last modified

2026-11-02 19:34:23.993000

View original CVE JSON

{
  "id": "CVE-2026-120627",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T18:18:52.733",
  "lastModified": "2026-11-02T19:34:23.993",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Private Internet Access",
          "product": "Firefox extension",
          "versions": [
            {
              "version": "3.2.5",
              "lessThanOrEqual": "4.0.5",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://addons.mozilla.org/en-US/firefox/addon/private-internet-access-ext/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Rexyysilent/PI-ay-ay-disclosure",
      "source": "[email protected]"
    }
  ]
}