CVE-2026-118180
published 2026-10-27CVE-2026-118180: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or…
PriorityP426medium6.5
EPSS
0.17%
6.9th percentile
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 153.6 | Thunderbird 153.6 |
| mozilla | thunderbird | < Thunderbird 159 | Thunderbird 159 |
| mozilla | thunderbird | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: thunderbird: Credential disclosure via unvalidated Matrix homeserver address
vendor_redhat·2026-10-27·CVSS 6.5
CVE-2026-118180 [MEDIUM] CWE-941 thunderbird: thunderbird: Credential disclosure via unvalidated Matrix homeserver address
thunderbird: thunderbird: Credential disclosure via unvalidated Matrix homeserver address
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A flaw was found in Thunderbird. When logging into a Matrix account, the application fails to validate the homeserver address returned in th
Mozilla
Mozilla Foundation Security Advisory 2026-122: CVE-2026-118180
vendor_mozilla
CVE-2026-118180 Mozilla Foundation Security Advisory 2026-122: CVE-2026-118180
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-118180
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
Mozilla
Mozilla Foundation Security Advisory 2026-121: CVE-2026-118180
vendor_mozilla
CVE-2026-118180 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118180
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118180
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
GHSA
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.
ghsa_unreviewed·2026-10-27
CVE-2026-118180 When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
No detection rules found.
No public exploits indexed.
2026-10-27
Published