Matrix Account Login Vulnerability in Thunderbird by Mozilla

CVE-2026-118180

What is CVE-2026-118180?

A vulnerability in Thunderbird allows unvalidated homeserver addresses during Matrix account logins. A compromised homeserver can manipulate the login response to redirect further requests to local file URLs or a malicious network share, especially on Windows systems. This misconfiguration leads to potential leaks of sensitive NTLM credentials, impacting user security. The issue has been addressed in versions 153.6 and 159.

References