Live › vulnerability › CVE-2026-113866
Go to dashboardWhen Thunderbird sets up an account, its Exchange AutoDiscover lookup also sends a request to the domain's AutoDiscover service over unencrypted HTTP. That request carried the password the user typed, so a network attacker can read it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Thunderbird versions before the fixed releases who sets up an Exchange account over a network an attacker can observe. The exposure comes from the account-setup step, so an existing configured account that is not re-added is less exposed. The sources do not say whether a specific account type or server configuration changes the risk.
No product ranges from the sources yet.
thunderbird --version (or check Help > About Thunderbird) and compare against the fixed versions.158.0.1 or 153.5.1, whichever matches your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-113866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.