Vulnerability · Published Nov 2, 2026 · Assigned by certcc
CVE-2026-120627CVE-2026-120627
Unrated
In plain English
A security flaw in Firefox extension from Private Internet Access. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Private Internet Access | Firefox extension | 3.2.5 – through 4.0.5 |