Session fixation in Mozilla VPN iOS 1.0.7
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-384.
Summary
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mozilla | Mozilla VPN iOS 1.0.7 | before (929) | (929) | Patch available | CNA |
| Mozilla | Mozilla VPN Windows | before 1.2.2 | 1.2.2 | Patch available | CNA |
| Mozilla | Mozilla VPN Android 1.1.0 | before (1360) | (1360) | Patch available | CNA |
- Mozilla VPN iOS 1.0.7 VendorMozilla Affected before (929) Fixed in (929) Patch available CNA
- Mozilla VPN Windows VendorMozilla Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
- Mozilla VPN Android 1.1.0 VendorMozilla Affected before (1360) Fixed in (1360) Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mozilla:vpn:*:*:*:*:*:iphone_os:*:* | before 1.0.7_\(929\) | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:vpn:*:*:*:*:*:windows:*:* | before 1.2.2 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:vpn:*:*:*:*:*:ipados:*:* | 1.0.7 to before 1.0.7_\(929\) | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:vpn:*:*:*:*:*:android:*:* | 1.1.0 to before 1.1.0_\(1360\) | Vulnerable | Mozilla |
- cpe:2.3:a:mozilla:vpn:*:*:*:*:*:iphone_os:*:* Versions before 1.0.7_\(929\) Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:vpn:*:*:*:*:*:windows:*:* Versions before 1.2.2 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:vpn:*:*:*:*:*:ipados:*:* Versions 1.0.7 to before 1.0.7_\(929\) Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:vpn:*:*:*:*:*:android:*:* Versions 1.1.0 to before 1.1.0_\(1360\) Vulnerable ·Mozilla
Remediation
- Fix · CNA Mozilla VPN iOS 1.0.7 (Mozilla) Fixed in (929)
- Fix · CNA Mozilla VPN Windows (Mozilla) Fixed in 1.2.2
- Fix · CNA Mozilla VPN Android 1.1.0 (Mozilla) Fixed in (1360)
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15679
- 2026-10-03 Alias added: GHSA-6pmm-vfgm-49r7
References
Patch 3
- https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f6758cd7ab7aa313e863047d41b
- https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98cf5d42993d484ee99b28d9
- https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39ac173665fad3f2598b54
More Mozilla Vpn vulnerabilities
- TI-2025-05127 Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. CVSS 3.1HIGH 7.8
- TI-2022-00437 Unrestricted file upload in Mozilla VPN CVSS 3.1HIGH 7.8
- TI-2023-03800 Missing authorization in Mozilla VPN 2.16.1 CVSS 3.1MEDIUM 5.5
Sources
- CVE-2020-15679 · CVE Program
- CVE-2020-15679 · NVD
- FIRST EPSS
- GHSA-6pmm-vfgm-49r7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences