Live › vulnerability › CVE-2026-118180
Go to dashboardWhen logging into a Matrix account, Thunderbird accepts a homeserver address from the server's login response without validating it. A malicious or compromised homeserver can supply a file: URL so that later Matrix requests go to local files or an attacker-controlled Windows network share, leaking the user's NTLM credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Thunderbird users who log into Matrix accounts from the chat feature. The NTLM credential leak applies only to Windows; other operating systems are unaffected. Users who do not use Matrix in Thunderbird are not exposed through this path.
No product ranges from the sources yet.
159 or 153.6 on the 153 branch are affected if Matrix chat is used.159 or to 153.6 on the 153 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118180")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.