{"id":"CVE-2026-126136","kind":"vulnerability","aliases":["CVE-2026-126136"],"related":[],"title":"Thunderbird: OAuth2 token sent over unencrypted HTTP for Exchange accounts","description":"For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160.","summary":"For Exchange accounts using EWS or Microsoft Graph with OAuth2, Thunderbird sent the access token even when the server URL was plain HTTP. A network observer could capture the token and read the user's mailbox until it expired.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exchange","oauth2","package","thunderbird"],"not_affected_if":["https-only-server-urls","no-exchange-accounts"],"how_to_check":"- Open Thunderbird and check the version under Help > About Thunderbird\n- Look at Exchange account server URLs in account settings for `http://` instead of `https://`","fix":"- Thunderbird `160` (fixed version stated by the source)","status":"open","published_at":"2026-11-10T19:21:14+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T20:04:45+00:00","updated_at":"2026-11-10T20:04:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:04:45Z","model":"claude-haiku-5-5","output":{"fix":"- Thunderbird `160` (fixed version stated by the source)","reach":"network","title":"Thunderbird: OAuth2 token sent over unencrypted HTTP for Exchange accounts","impact":"high","summary":"For Exchange accounts using EWS or Microsoft Graph with OAuth2, Thunderbird sent the access token even when the server URL was plain HTTP. A network observer could capture the token and read the user's mailbox until it expired.","audience":"everyone","category":"package","nicknames":[],"who_cares":["thunderbird","exchange","oauth2"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads mailbox using captured OAuth2 access token","analyst_note":"","how_to_check":"- Open Thunderbird and check the version under Help > About Thunderbird\n- Look at Exchange account server URLs in account settings for `http://` instead of `https://`","plain_action":"Update Thunderbird to version 160 or later: Help > About Thunderbird.","product_name":"","needs_analyst":false,"not_affected_if":["https-only-server-urls","no-exchange-accounts"],"who_is_affected":"Users of Thunderbird with Exchange accounts that use EWS or Microsoft Graph with OAuth2 sign-in, particularly where the server URL was configured as plain HTTP. Accounts using only IMAP, POP or HTTPS Exchange endpoints are not affected by the source's description. Exposure requires a network position to observe traffic.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4610,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126136':13A,16A '-2026':12A,15A '160':136C 'abl':91C 'access':34B,75C,104C 'account':10A,23B,62C,120C 'attack':90C,114C 'authent':70C 'captur':48B 'caus':123C 'configur':83C,129C 'could':47B,96C,122C 'cve':11A,14A 'even':36B,80C 'ew':25B,64C 'exchang':9A,17B,22B,61C 'expir':59B,112C 'fix':133C 'graph':28B,67C 'http':7A,43B,88C 'mailbox':56B,108C 'microsoft':27B,66C 'network':45B,94C,118C 'oauth2':2A,18B,30B,69C,74C 'observ':46B,93C 'obtain':97C 'packag':19B 'plain':42B 'posit':115C 'read':52B 'sent':4A,32B,72C 'server':39B,79C,84C 'setup':121C 'thunderbird':1A,20B,31B,71C,135C 'token':3A,35B,50B,76C,99C,111C 'traffic':95C 'unencrypt':6A,87C 'url':40B,85C,126C 'use':24B,63C,86C,101C 'user':54B,106C 'vulner':131C","nicknames":[],"mitigations":[],"who_affected":"Users of Thunderbird with Exchange accounts that use EWS or Microsoft Graph with OAuth2 sign-in, particularly where the server URL was configured as plain HTTP. Accounts using only IMAP, POP or HTTPS Exchange endpoints are not affected by the source's description. Exposure requires a network position to observe traffic.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Thunderbird to version 160 or later: Help > About Thunderbird.","pkeys":[],"ptokens":[],"labels":["exchange","medium","oauth2","package","thunderbird"],"campaign_type":null,"search_a":"'-126136':13A,16A '-2026':12A,15A 'account':10A 'cve':11A,14A 'exchang':9A 'http':7A 'oauth2':2A 'sent':4A 'thunderbird':1A 'token':3A 'unencrypt':6A","search_b":"'access':34B 'account':23B 'captur':48B 'could':47B 'even':36B 'ew':25B 'exchang':17B,22B 'expir':59B 'graph':28B 'http':43B 'mailbox':56B 'microsoft':27B 'network':45B 'oauth2':18B,30B 'observ':46B 'packag':19B 'plain':42B 'read':52B 'sent':32B 'server':39B 'thunderbird':20B,31B 'token':35B,50B 'url':40B 'use':24B 'user':54B","search_c":"'160':136C 'abl':91C 'access':75C,104C 'account':62C,120C 'attack':90C,114C 'authent':70C 'caus':123C 'configur':83C,129C 'could':96C,122C 'even':80C 'ew':64C 'exchang':61C 'expir':112C 'fix':133C 'graph':67C 'http':88C 'mailbox':108C 'microsoft':66C 'network':94C,118C 'oauth2':69C,74C 'observ':93C 'obtain':97C 'posit':115C 'sent':72C 'server':79C,84C 'setup':121C 'thunderbird':71C,135C 'token':76C,99C,111C 'traffic':95C 'unencrypt':87C 'url':85C,126C 'use':63C,86C,101C 'user':106C 'vulner':131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126136","severity":null,"published_at":"2026-11-10T19:21:14+00:00","modified_at":"2026-11-10T19:21:14+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}