CVE-2026-85268

UNKNOWN

Published 2026-10-30 · Source f45cbf4e-4146-4068-b7e1-655ffc2c548c

Description

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

CWE-79

References

https://firebase.google.com/support/releases#auth-helper-fix

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-110972
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110971
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-110970
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002.
2026-10-30 · score —
CVE-2026-105924
A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.
2026-10-30 · score —
CVE-2025-68395
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
2026-10-30 · score —