{"id":"CVE-2026-120627","kind":"vulnerability","aliases":["CVE-2026-120627"],"related":[],"title":"Private Internet Access Firefox extension leaks proxy credentials to malicious websites","description":"The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.","summary":"The Private Internet Access extension for Firefox has an unguarded onAuthRequired handler that answers Basic auth challenges from any site. A visited malicious website can therefore obtain the user's PIA proxy credentials.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser-extension","firefox","other","private-internet-access"],"not_affected_if":["extension-not-installed","other-browser"],"how_to_check":"- Check the installed Private Internet Access extension version in Firefox's Add-ons manager (about:addons)\n- Compare the version against the fixed release `3.2.5` and later affected versions as described in the source","fix":"- Private Internet Access extension for Firefox: the source says version `3.2.5` fixed the issue but it was reintroduced in later versions; no safe version is named","status":"open","published_at":"2026-11-02T18:18:52+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:39+00:00","updated_at":"2026-11-02T18:24:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T18:24:39Z","model":"claude-haiku-5-5","output":{"fix":"- Private Internet Access extension for Firefox: the source says version `3.2.5` fixed the issue but it was reintroduced in later versions; no safe version is named","reach":"internet","title":"Private Internet Access Firefox extension leaks proxy credentials to malicious websites","impact":"medium","summary":"The Private Internet Access extension for Firefox has an unguarded onAuthRequired handler that answers Basic auth challenges from any site. A visited malicious website can therefore obtain the user's PIA proxy credentials.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","private-internet-access","browser-extension"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"proxy credentials are leaked to any malicious website","analyst_note":"Confirm which later extension versions are affected and the fixed release line from the NVD entry and the vendor's advisory.","how_to_check":"- Check the installed Private Internet Access extension version in Firefox's Add-ons manager (about:addons)\n- Compare the version against the fixed release `3.2.5` and later affected versions as described in the source\n- unknown for any further checks, since the sources do not say which later versions are affected","plain_action":"Check your Private Internet Access Firefox extension version and update it or remove it until the vendor confirms a fixed release.","needs_analyst":true,"not_affected_if":["extension-not-installed","other-browser"],"who_is_affected":"Anyone who uses the Private Internet Access browser extension in Firefox with PIA proxy credentials, whenever they visit a website that issues a Basic auth challenge. Users who do not run the extension in Firefox are not exposed by this description.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4119,"output_tokens":629,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120627':14A,17A '-2026':13A,16A '3.2.5':99C 'access':3A,26B,30B,63C 'answer':40B 'auth':42B,91C 'authent':71C 'basic':41B,90C 'browser':19B 'browser-extens':18B 'challeng':43B,92C 'contain':67C 'credenti':8A,59B,79C 'cve':12A,15A 'extens':5A,20B,31B,64C 'firefox':4A,21B,33B,66C 'fix':96C 'handler':38B,72C 'internet':2A,25B,29B,62C 'issu':88C,94C 'later':103C 'lead':73C 'leak':6A 'leakag':75C 'malici':10A,49B,85C 'obtain':53B 'onauthrequir':37B,70C 'pia':57B,77C 'privat':1A,24B,28B,61C 'private-internet-access':23B 'proxi':7A,58B,78C 'reintroduc':101C 'site':46B 'therefor':52B 'unguard':36B,69C 'user':55B,82C 'version':98C,104C 'visit':48B,83C 'websit':11A,50B,86C","nicknames":[],"mitigations":[],"who_affected":"Anyone who uses the Private Internet Access browser extension in Firefox with PIA proxy credentials, whenever they visit a website that issues a Basic auth challenge. Users who do not run the extension in Firefox are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check your Private Internet Access Firefox extension version and update it or remove it until the vendor confirms a fixed release.","pkeys":[],"ptokens":[],"labels":["browserextension","firefox","medium","other","privateinternetaccess"],"first_public_at":"2026-11-02T18:18:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120627","severity":null,"published_at":"2026-11-02T18:18:52+00:00","modified_at":"2026-11-02T18:18:52+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}