Credential Leakage in Thunderbird During Exchange AutoDiscover Setup
CVE-2026-113866

5.9MEDIUM

Key Information:

Vendor

Mozilla
Status
Thunderbird
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113866?

A vulnerability in Thunderbird's Exchange AutoDiscover setup allowed attackers to intercept unencrypted HTTP requests that contained user credentials during the account setup process. This incident occurred when the AutoDiscover lookup queried the domain's service over plain HTTP instead of HTTPS, exposing sensitive information to potential network-based attacks. Mozilla addressed this significant issue in Thunderbird version 158.0.1 and version 153.5.1.

Affected Version(s)

Thunderbird 153.5.1

Thunderbird 158.0.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2080121
https://www.mozilla.org/security/advisories/mfsa2026-114/
https://www.mozilla.org/security/advisories/mfsa2026-115/

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Magnus Melin
.