The bug is a cross-site scripting flaw that left session IDs susceptible to theft during the interaction between Yahoo! mail and the Yahoo! Messenger instant messaging client.

Researchers at Cenzic found the flaw in May, and collaborated with Yahoo! in fixing the problem. Yahoo! says it fixed the bug on June 13, which was soon followed by Cenzic posting a detailed advisory on the issue.

The advisory describes that the hacker would have first had to add the proposed victim as a "buddy" before launching the attack. This would have only worked if the Yahoo! mail user had set up the Messenger support.

Cenzic writes: "If the attacker is using the Yahoo! Messenger desktop application 8.1.0.209 to chat with the victim, and the victim is using the Messenger support in the new Yahoo! Mail Web application, it will cause a new chat tab to open in the victim's browser. While chatting, the attacker can change their status to "invisible" causing a message of "offline" in the chat tab of the victim.

"The vulnerability occurred when the attacker then changed status, and sent a custom message containing a malicious string in the form of a status message of "online", with the script executed in the context of Yahoo! Mail on the victim's machine. This allowed an attacker to get active access to the victim's session ID, and in turn steal their Yahoo! identity, exposing sensitive personal information stored in their Yahoo! account."

The full Ceznic advisory can be viewed here.

Another security flaw was found in May in rival webmail service Google Gmail, which could enable spammers to use the free mail service as an open relay server.

In another setback to Yahoo!'s Webmail service, the company recently dropped security and anti-spam enhancements to the service after discovering the features prevented users from retrieving POP email from their external accounts.