UBUNTU-CVE-2026-126136: Medium severity ubuntu/thunderbird vulnerability
For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exchange accounts configured in Thunderbird to use EWS or Microsoft Graph with OAuth2 authentication are exposed if their configured server URL uses unencrypted HTTP. The impact is limited to users whose OAuth2 token can be observed on the network.
What does an attacker need to exploit it?
An attacker must be able to observe the victim's network traffic when Thunderbird sends the OAuth2 access token over HTTP. An attacker present on the network during account setup could also cause an unencrypted server URL to be configured.
What can an attacker do with a captured token?
A captured OAuth2 access token can be used to access the user's mailbox until that token expires.
What should be checked if updating is not immediately possible?
Check Exchange account configurations using EWS or Microsoft Graph with OAuth2 and ensure their server URLs use HTTPS rather than unencrypted HTTP. Avoid configuring or accepting HTTP server URLs during account setup.
Which Thunderbird releases contain the fix?
The issue was fixed in Thunderbird 160 and Thunderbird 153.7.