The Private Internet Access Firefox extension contains an unguarded onAuthRequired authentication handler. When a user visits a malicious website that issues a Basic authentication challenge, the extension unintentionally leaks the user’s PIA proxy credentials to the attacker. The leaked data includes the username and password used to authenticate with the PIA proxy service, enabling an attacker to impersonate the victim on the VPN network and potentially access all of the user’s network traffic.

The vulnerability is limited to the Private Internet Access extension for Mozilla Firefox. Version 3.2.5 corrected the defect, but the same issue was reintroduced in later releases. Users running any Private Internet Access extension version newer than 3.2.5 are potentially affected until a further patch is released.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, yet the nature of the flaw gives it high exploitation potential. An attacker can trigger credential leakage simply by persuading a user to visit a malicious page that sends a Basic auth request. Once the credentials are captured, an attacker can use them to tunnel traffic through the victim’s VPN connection, compromising confidentiality and integrity of all data transmitted through the proxy.