CVE-2020-6823

A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75.

• CWE-862

• https://bugzilla.mozilla.org/show_bug.cgi?id=1614919Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-12/Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1614919Issue Tracking, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-12/Third Party Advisory

Published

Apr 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clea…6.1
• CVE-2020-6817bleach.clean behavior parsing style attributes could result …7.5
• CVE-2020-6819Under certain conditions, when running the nsDocShell destru…8.1
• CVE-2020-6820Under certain conditions, when handling a ReadableStream, a …8.1
• CVE-2020-6821When reading from areas partially or fully outside the sourc…7.5
• CVE-2020-6822On 32-bit builds, an out of bounds write could have occurred…8.8
• CVE-2020-6824Initially, a user opens a Private Browsing Window and genera…2.8
• CVE-2020-6825Mozilla developers and community members Tyson Smith and Chr…9.8
• CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Mic…9.8
• CVE-2020-6827When following a link that opened an intent://-schemed URL, …4.7
• CVE-2020-6828A malicious Android application could craft an Intent that w…7.5
• CVE-2020-6829When performing EC scalar point multiplication, the wNAF poi…5.3