CVE-2025-0245 — Missing Authentication for Critical Function in Mozilla Firefox

CWE-306 — Missing Authentication for Critical FunctionCWE-288 — Authentication Bypass Using an Alternate Path or ChannelCWE-284 — Improper Access Control15 documents8 sources
Severity
9.1CRITICALNVD
NVD3.3CNA3.3OSV3.3
EPSS
0.0%
top 99.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedJan 7
Latest updateMar 4

Description

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixed in Firefox 134.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages1 packages

▶NVDmozilla/firefox< 134.0+1

🔴Vulnerability Details

6
OSV
CVE-2025-1941: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-↗2025-03-04
▶
GHSA
GHSA-m793-xp46-r76w: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-↗2025-03-04
▶
CVEList
Lock screen setting bypass in Firefox Focus for Android↗2025-03-04
▶
OSV
CVE-2025-0245: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed↗2025-01-07
▶
CVEList
Lock screen setting bypass in Firefox Focus for Android↗2025-01-07
▶

📋Vendor Advisories

6
Red Hat
firefox: Lock screen setting bypass in Firefox Focus for Android↗2025-03-04
▶
Red Hat
firefox: Lock screen setting bypass in Firefox Focus for Android↗2025-01-07
▶
Debian
CVE-2025-0245: firefox - Under certain circumstances, a user opt-in setting that Focus should require aut...↗2025
▶
Debian
CVE-2025-1941: firefox - Under certain circumstances, a user opt-in setting that Focus should require aut...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-14: CVE-2025-0245↗
▶

💬Community

1
Bugzilla
Firefox Focus security bug: "Use fingerprint to unlock app" bypass (new variant)↗2025-01-29
▶
CVE-2025-0245 — Mozilla Firefox vulnerability | cvebase