CVE-2026-113866 in Thunderbird
Summary
by MITRE • 10/20/2026
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified involves a critical flaw in Mozilla Thunderbird’s Exchange AutoDiscover mechanism during account configuration. When users set up an email account using Microsoft Exchange protocols, Thunderbird attempts to locate the correct mail server settings by querying the domain's AutoDiscover service. This process is essential for automating the setup of complex enterprise email environments where server addresses and ports may vary or be dynamically assigned. However, a bug in this implementation caused Thunderbird to initiate these lookup requests over plain HTTP rather than enforcing secure HTTPS connections as required by modern security standards and best practices for handling sensitive configuration data.
The technical flaw lies specifically in the protocol negotiation phase of the AutoDiscover process. Instead of verifying that the connection is encrypted or falling back to a secure method if encryption cannot be established, Thunderbird proceeded with an unencrypted HTTP request. This behavior exposes the entire payload of the initial handshake and subsequent queries to potential interception. In many corporate environments, network traffic may traverse multiple hops through routers, switches, and firewalls before reaching its destination. Any device on this path that is capable of passive sniffing can capture the transmitted data packets without needing active intervention or privilege escalation within the local network segment.
The operational impact of this vulnerability is severe due to the nature of the data exposed during the AutoDiscover lookup. The unencrypted HTTP request included the credentials entered by the user, specifically their username and password. This means that any attacker with access to the same network infrastructure as the victim could perform a man-in-the-middle attack or simple packet sniffing to harvest these authentication details. Once obtained, these credentials can be used for unauthorized access to the user's email account, potentially leading to data exfiltration, phishing campaigns using the compromised identity, or lateral movement within an organization if the same password is reused across other systems. This represents a significant breach of confidentiality and integrity principles in information security.
From a classification perspective, this vulnerability aligns with CWE-319, which describes cleartext transmission of sensitive information over a network that is not protected by adequate cryptographic mechanisms. It also relates to CWE-256, the storage or use of plaintext passwords, although in this case, it is more about transient exposure during transit rather than static storage. In terms of adversary tactics, this flaw facilitates reconnaissance and credential harvesting activities often associated with initial access vectors where attackers seek low-effort opportunities to gain footholds within a network by exploiting misconfigured software behavior.
To mitigate the risks associated with such vulnerabilities, organizations should ensure that all email clients are updated to versions that enforce secure connections for administrative lookups like AutoDiscover. In this specific instance, Mozilla addressed the issue in Thunderbird version 158.0.1 by correcting the protocol selection logic to prioritize HTTPS and reject insecure fallbacks when dealing with credential-bearing requests. Administrators should also implement network-level protections such as TLS inspection policies that are properly configured to avoid breaking encrypted traffic while ensuring that internal services enforce strong authentication protocols. Additionally, users should be educated about the importance of keeping their email clients updated to patch known security defects that could compromise their account integrity.