Authorization Bypass

firefox and thunderbird are vulnerable to Authorization Bypasses. The vulnerability occurs when the number of cookies per domain is exceeded in document.cookie. The actual cookie jar sent to the host is no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. An attacker could exploit this vulnerability by creating a malicious website that could cause Firefox to send requests with some cookies missing, resulting in authentication bypass or to use the stolen cookies to be used to access other websites.