Private Internet Access Firefox extension leaks proxy credentials
Visiting a malicious site can leak your PIA login details.
Summary
The Private Internet Access Firefox extension has an unguarded authentication handler, so visiting a malicious site that issues a Basic auth challenge can leak PIA proxy credentials. It was fixed in 3.2.5 but reintroduced in later versions.
Affected when
- PIA Firefox extension installed, versions 3.2.5 to 4.0.5
- Visiting a malicious website that issues a Basic auth challenge
What to do
Check that the installed PIA extension is newer than 4.0.5, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen