CVE-2026-113866

Published: Oct 20, 2026Modified: Oct 22, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Related CWEs

CWE-523

Unprotected Transport of Credentials

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=2080121

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-114/

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2026-115/

Source: security@mozilla.org

Timeline

No history available yet.