Mozilla VPN vulnerabilities

4 CVEs affecting Mozilla VPN, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-5687, published 2025-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-15679, published 2022-12-22. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as…
CVE-2023-4104, published 2023-09-11. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux.…
CVE-2022-0517, published 2022-12-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This…
CVE-2025-5687, published 2025-06-11. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.*. This…