{"id":"CVE-2026-118180","kind":"vulnerability","aliases":["CVE-2026-118180"],"related":[],"title":"Thunderbird: Matrix login trusts server-supplied file URL, leaking Windows NTLM credentials","description":"When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","summary":"When logging into a Matrix account, Thunderbird accepts a homeserver address from the server's login response without validating it. A malicious or compromised homeserver can supply a file: URL so that later Matrix requests go to local files or an attacker-controlled Windows network share, leaking the user's NTLM credentials.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["matrix","package","thunderbird","windows"],"not_affected_if":["no-matrix-use","non-windows"],"how_to_check":"- Check the Thunderbird version under Help > About Thunderbird; versions below `159` or `153.6` on the 153 branch are affected if Matrix chat is used.\n- Check whether the Matrix chat feature is in use on Windows clients, since the NTLM leak is Windows-only.","fix":"- Update Thunderbird to `159` or to `153.6` on the 153 line.","status":"open","published_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:05+00:00","updated_at":"2026-10-27T19:35:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T19:35:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update Thunderbird to `159` or to `153.6` on the 153 line.","reach":"network","title":"Thunderbird: Matrix login trusts server-supplied file URL, leaking Windows NTLM credentials","impact":"medium","summary":"When logging into a Matrix account, Thunderbird accepts a homeserver address from the server's login response without validating it. A malicious or compromised homeserver can supply a file: URL so that later Matrix requests go to local files or an attacker-controlled Windows network share, leaking the user's NTLM credentials.","category":"package","nicknames":[],"who_cares":["thunderbird","matrix","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Windows NTLM credentials leak to an attacker-controlled network share","analyst_note":"","how_to_check":"- Check the Thunderbird version under Help > About Thunderbird; versions below `159` or `153.6` on the 153 branch are affected if Matrix chat is used.\n- Check whether the Matrix chat feature is in use on Windows clients, since the NTLM leak is Windows-only.","needs_analyst":false,"not_affected_if":["non-windows","no-matrix-use"],"who_is_affected":"Thunderbird users who log into Matrix accounts from the chat feature. The NTLM credential leak applies only to Windows; other operating systems are unaffected. Users who do not use Matrix in Thunderbird are not exposed through this path.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3391,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118180':16A,19A '-2026':15A,18A '153.6':164C '159':161C 'accept':31B 'account':29B,83C 'address':34B,88C 'affect':146C 'attack':66B,129C 'attacker-control':65B,128C 'caus':109C 'compromis':47B,102C 'control':67B,130C 'could':104C,134C 'credenti':13A,76B,140C,143C 'cve':14A,17A 'file':8A,52B,62B,107C,122C 'fix':158C 'go':59B 'homeserv':33B,48B,87C,103C 'later':56B 'leak':10A,71B,135C,144C 'local':61B,121C 'log':25B,78C 'login':3A,39B,94C 'malici':45B,100C 'matrix':2A,20B,28B,57B,82C,115C 'network':69B,131C 'ntlm':12A,75B,139C,142C 'oper':151C 'packag':21B 'provid':89C,105C 'request':58B,116C 'respons':40B,95C 'send':112C 'server':6A,37B,92C 'server-suppli':5A 'session':119C 'share':70B,132C 'suppli':7A,50B 'system':152C 'thunderbird':1A,22B,30B,84C,110C,147C,160C,163C 'trust':4A 'unaffect':154C 'url':9A,53B,108C 'use':85C 'user':73B,137C 'valid':42B,97C 'vulner':156C 'window':11A,23B,68B,125C,149C 'without':41B,96C","nicknames":[],"mitigations":[],"who_affected":"Thunderbird users who log into Matrix accounts from the chat feature. The NTLM credential leak applies only to Windows; other operating systems are unaffected. Users who do not use Matrix in Thunderbird are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118180","severity":null,"published_at":"2026-10-27T19:17:29+00:00","modified_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}