CVE-2026-113866
published 2026-10-20CVE-2026-113866: When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that…
PriorityP337medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.36%
30.2th percentile
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 158.0.1 | Thunderbird 158.0.1 |
| mozilla | thunderbird | < Thunderbird 153.5.1 | Thunderbird 153.5.1 |
| mozilla | thunderbird | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
vendor_redhat·2026-10-20·CVSS 5.9
CVE-2026-113866 [MEDIUM] CWE-523 thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
thunderbird: thunderbird: Information disclosure via unencrypted AutoDiscover lookup
A flaw was found in Thunderbird. An information disclosure issue occurs during account setup when the Exchange AutoDiscover feature transmits requests over unencrypted Hypertext Transfer Protocol (HTTP). A network attacker monitoring traffic can intercept these plaintext requests, exposing the user's entered credentials and leading to unauthorized account access.
Package: thunderbird (Red Hat Enterprise Linux 10) - Fix deferred
Package: thunderbird (Red Hat Enterprise Linux 8) - Fix deferred
Package: thunderbird (Red Hat Enterprise Linux 9) - Fix deferred
Mozilla
Mozilla Foundation Security Advisory 2026-114: CVE-2026-113866
vendor_mozilla
CVE-2026-113866 Mozilla Foundation Security Advisory 2026-114: CVE-2026-113866
Mozilla Foundation Security Advisory 2026-114
CVE: CVE-2026-113866
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-115: CVE-2026-113866
vendor_mozilla
CVE-2026-113866 Mozilla Foundation Security Advisory 2026-115: CVE-2026-113866
Mozilla Foundation Security Advisory 2026-115
CVE: CVE-2026-113866
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153.5.1
GHSA
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP.
ghsa_unreviewed·2026-10-20
CVE-2026-113866 [MEDIUM] CWE-523 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP.
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
No detection rules found.
No public exploits indexed.
2026-10-20
Published