An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).
An official patch is available. Apply the patch as soon as possible.
CVSS v4.0 Metrics
Exploitability
Attack VectorNetwork
ComplexityLow
RequirementsPresent
PrivilegesNone
User InteractionActive
Threat
Exploit MaturityPoC
Vulnerable System
ConfidentialityLow
IntegrityLow
AvailabilityHigh
Subsequent System
ConfidentialityNone
IntegrityNone
AvailabilityNone
Supplemental
SafetyNegligible
AutomatableYes
RecoveryAutomatic
Value DensityConcentrated
UrgencyMedium
Patch StatusOfficial Patch
Change Log
| Date | Source | Changes | Score |
|---|
| 2026-07-21 | PoC | E: U→P | 2.2 → 5.3 |
| 2026-07-21 | nvd | patch: Unavailable→Official Patch | 2.2 → 2.2 |
| 2026-07-21 | cve.org | initial, patch: Unavailable | 2.2 |
Affected Software
| Vendor | Product | Version |
|---|
| Mozilla | Mozilla VPN Android 1.1.0 | < (1360) |
| Mozilla | Mozilla VPN iOS 1.0.7 | < (929) |
| Mozilla | Mozilla VPN Windows | < 1.2.2 |
| mozilla | vpn | < 1.0.7_\(929\) |
| mozilla | vpn | < 1.2.2 |
| mozilla | vpn | ≥ 1.0.7, < 1.0.7_\(929\) |
| mozilla | vpn | ≥ 1.1.0, < 1.1.0_\(1360\) |
Published: 2022-12-22
