What’s Vulnerable › Vulnerabilities
CVE-2020-12624
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-05-03 · updated 2026-06-17
- Weakness: CWE-459
Description
The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.
Affected products
- Theleague The League: before 2020-05-02 — fixed in 2020-05-02
How to fix
Upgrade to a fixed version: Theleague The League 2020-05-02. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2020-12624 or the next vulnerability affects your stack