https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T18:23:52.219285+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-11023 CVE-2024-11023 — Session Hijacking in Firebase JavaScript SDK 2026-10-16T18:23:52.220627+00:00

Affected: Firebase JavaScript SDK

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.