CVE-2020-15679

CVE-2020-15679 describes an OAuth session fixation vulnerability in Mozilla VPN’s login flow. Affected software includes Mozilla VPN iOS up to 1.0.7, Mozilla VPN Windows prior to 1.2.2, and Mozilla VPN Android up to 1.1.0. Root cause: vulnerability in the login process that allows an attacker (sh...

CVE-2023-4104

CVE-2023-4104 affects Mozilla VPN on Linux. The root cause is an invalid Polkit authentication check and missing authentication requirements for D-Bus methods, enabling any local user to configure arbitrary VPN setups. Impact is limited to Mozilla VPN on Linux; other OSes are unaffected. Mozilla ...

CVE-2022-0517

Mozilla VPN is affected by a local privilege escalation vulnerability where an OpenSSL configuration file can be loaded from an unsecured directory. This allows a user or low-privilege attacker to execute arbitrary code with SYSTEM privileges on affected builds prior to 2.7.1. Remediation is to u...

CVE-2025-5687

A local privilege escalation vulnerability exists in Mozilla VPN on macOS , affecting versions 2.27.0 and earlier (or 2.28.0 and earlier depending on the source). The flaw stems from errors in the use of standard permissions , allowing an attacker to escalate privileges from a normal user to root...