[ CVE-2026-113866 · Published 20 Oct 2026 ]
Vulnerability in Mozilla Thunderbird
CVSS 5.9
EPSS <1%2 agency advisoriesFix available
[ Description ]Official description
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
[ Fixes ]Fixes and patches
- Security bulletin: Mozilla mfsa2026-115Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-115, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-113Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-113, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-114Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-114, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-111Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-111, cited by CERT-FR CERTFR-2026-AVI-1346
- Security bulletin: Mozilla mfsa2026-112Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-112, cited by CERT-FR CERTFR-2026-AVI-1346
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1346
Multiple vulnerabilities in Mozilla products Translated from French
Multiple vulnerabilities have been discovered in Mozilla products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and denial of service.
-
BSI CERT-BundWID-SEC-2026-4064
Mozilla products (Thunderbird, Firefox ESR and Firefox): Multiple vulnerabilities Translated from German