{"action":"Upgrade firebase to 10.9.0 or later.","affected":[{"fixed":"10.9.0","introduced":"0"}],"component":"firebase","cve_ids":["CVE-2024-11023"],"ecosystem":"npm","epss":0.00134,"exploited":false,"fixed_versions":["10.9.0"],"ghsa_id":"GHSA-3wf4-68gx-mph8","id":"tcs_01M5KEYF167G7N97NG7V361XV8","modified_at":"2025-07-23T22:12:58Z","published_at":"2024-11-18T12:30:42Z","references":["https://osv.dev/vulnerability/GHSA-3wf4-68gx-mph8","https://nvd.nist.gov/vuln/detail/CVE-2024-11023","https://github.com/firebase/firebase-js-sdk/pull/8056","https://github.com/firebase/firebase-js-sdk/commit/245dd26e19b6c16aca7e1b7e597ed5784c2984ba","https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024","https://github.com/firebase/firebase-js-sdk"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-3wf4-68gx-mph8","url":"https://osv.dev/vulnerability/GHSA-3wf4-68gx-mph8"}],"summary":"Firebase JavaScript SDK allows attackers to manipulate the \"_authTokenSyncURL\" to point to their own server"}