CVE-2026-120627

{"id": "CVE-2026-120627", "cveTags": [], "metrics": {}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Private Internet Access", "product": "Firefox extension", "versions": [{"status": "affected", "version": "3.2.5", "versionType": "custom", "lessThanOrEqual": "4.0.5"}]}]}], "published": "2026-11-02T18:18:52.733", "references": [{"url": "https://addons.mozilla.org/en-US/firefox/addon/private-internet-access-ext/", "source": "cret@cert.org"}, {"url": "https://github.com/Rexyysilent/PI-ay-ay-disclosure", "source": "cret@cert.org"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions."}], "lastModified": "2026-11-02T19:34:23.993", "sourceIdentifier": "cret@cert.org"}