---
id: "CVE-2026-126136"
page: "https://infrastack.ai/live/CVE-2026-126136"
kind: "vulnerability"
aliases: ["CVE-2026-126136"]
title: "Thunderbird: OAuth2 token sent over unencrypted HTTP for Exchange accounts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["exchange", "oauth2", "package", "thunderbird"]
not_affected_if: ["https-only-server-urls", "no-exchange-accounts"]
published_at: "2026-11-10T19:21:14+00:00"
first_seen_at: "2026-11-10T19:25:15+00:00"
updated_at: "2026-11-10T20:04:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126136", "first_seen_at": "2026-11-10T19:25:15+00:00"}]
exploit_sources: []
---

# Thunderbird: OAuth2 token sent over unencrypted HTTP for Exchange accounts

Link for people: https://infrastack.ai/live/CVE-2026-126136 (this .md is for agents)

For Exchange accounts using EWS or Microsoft Graph with OAuth2, Thunderbird sent the access token even when the server URL was plain HTTP. A network observer could capture the token and read the user's mailbox until it expired.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Thunderbird and check the version under Help > About Thunderbird
- Look at Exchange account server URLs in account settings for `http://` instead of `https://`

## Fix

- Thunderbird `160` (fixed version stated by the source)

## Timeline

- 2026-11-10T19:25:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126136

## From the sources

For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_