What’s Vulnerable › Vulnerabilities

CVE-2024-11023: Session Hijacking in Firebase JavaScript SDK

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Affected products

• Firebase JavaScript SDK: before 10.9.0 — fixed in 10.9.0

How to fix

Upgrade to a fixed version: Firebase JavaScript SDK 10.9.0. Check the vendor advisory for mitigations.

References

• https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024
• https://github.com/firebase/firebase-js-sdk/pull/8056

Get alerted when CVE-2024-11023 or the next vulnerability affects your stack