CVE-2024-11023

Session Hijacking in Firebase JavaScript SDK

5.2 MediumFix available

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Active

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.13%Up 0.1 points since Nov 19, 2024

What each source reports

CVE List Score used 5.2

Session Hijacking in Firebase JavaScript SDK

Record: CVE-2024-11023
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2024-3188 5.2

Record: EUVD-2024-3188
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3wf4-68gx-mph8 5.2

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Record: GHSA-3wf4-68gx-mph8
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 5.2

Record: CVE-2024-11023
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.2

Session Hijacking in Firebase JavaScript SDK

Record: CVE-2024-11023
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-3wf4-68gx-mph8 5.2

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Record: GHSA-3wf4-68gx-mph8
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`firebase` npm	before 10.9.0	10.9.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11023 is a medium vulnerability (CVSS 5.2) in Firebase Javascript Sdk, published November 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in firebase 10.9.0.