CVE-2026-113866: Account password sent unencrypted during Exchange account setup
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.5.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who is exposed to credential theft?
Users setting up an Exchange account in affected Thunderbird versions are exposed. A network attacker able to observe or interfere with the plain-HTTP AutoDiscover request could obtain the password entered during setup.
Does exploitation require an existing account or user interaction?
No existing account privileges are required by the attacker, but the user must be setting up an Exchange account and enter credentials. The CVSS vector indicates no additional user interaction is required beyond that setup activity.
Which versions contain the fix?
The issue was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.