CVE-2020-12624

6.5 mediumEPSS 1.3%

Medium (6.5) in theleague the league. EPSS 1.3% chance of exploitation in the next 30 days.

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-459
Published: 2020-05-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

theleague:the_league

References

https://push32.com/post/dating-app-fail/
https://push32.com/post/dating-app-fail/

Check your stack JSON