Bugzilla Zero-Day Exposes Zero-Day Bugs
Summary: Check Point researchers found a Bugzilla flaw that let them create accounts bypassing email validation, and by registering as admin@mozilla.org they gained access to confidential bug groups and permissions to edit bugs. Bugzilla released an update for the vulnerability, which Mozilla's Sid Stamm said allows manipulation of database fields including 'login_name' at account creation, and which researcher Shahar Tal said had been present for 10 years.
Why it matters: A bug tracker holds the unfixed vulnerabilities in Firefox and other projects before patches exist, and Tal noted there is no way to know whether nation-state adversaries already exploited the flaw other than reviewing user lists for a suspicious account.
Read the original at Krebs on Security ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026