CVE-2026-113866

MEDIUM 5.9

Account password sent unencrypted during Exchange account setup

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Vendor	mozilla
Product	thunderbird
Ecosystems	Browser JavaScript
Industries	Technology
Published	Oct 20, 2026
Last Updated	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for mozilla thunderbird

Be the first to know when new medium vulnerabilities affecting mozilla thunderbird are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Thunderbird

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=2080121 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-114/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-115/

Credits

Magnus Melin