---
id: "CVE-2026-120627"
kind: "vulnerability"
aliases: ["CVE-2026-120627"]
title: "Private Internet Access Firefox extension leaks proxy credentials to malicious websites"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["browser-extension", "firefox", "other", "private-internet-access"]
not_affected_if: ["extension-not-installed", "other-browser"]
published_at: "2026-11-02T18:18:52+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:24:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120627", "first_seen_at": "2026-11-02T18:24:24+00:00"}]
---

# Private Internet Access Firefox extension leaks proxy credentials to malicious websites

The Private Internet Access extension for Firefox has an unguarded onAuthRequired handler that answers Basic auth challenges from any site. A visited malicious website can therefore obtain the user's PIA proxy credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Private Internet Access extension version in Firefox's Add-ons manager (about:addons)
- Compare the version against the fixed release `3.2.5` and later affected versions as described in the source

## Fix

- Private Internet Access extension for Firefox: the source says version `3.2.5` fixed the issue but it was reintroduced in later versions; no safe version is named

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120627

## From the sources

The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_