CVE-2026-118180 in Thunderbird
Summary
by MITRE • 10/27/2026
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability represents a critical input validation failure within the Matrix protocol implementation of Mozilla Thunderbird, specifically affecting the authentication workflow during account login. When a user initiates a login sequence against a Matrix homeserver, the server responds with configuration details that include the base URL for subsequent API requests. In this flawed scenario, Thunderbird accepts and utilizes the homeserver address provided in this response without performing any sanitization or validation checks to ensure it conforms to expected protocols such as HTTPS or HTTP. This lack of verification creates a significant security gap where an attacker controlling or compromising a Matrix server can manipulate the client's behavior by injecting malicious URLs into the login response payload.
The technical core of this flaw lies in Thunderbird's blind trust of the homeserver address, which allows for protocol manipulation attacks such as file: URL injection. By supplying a file: URI scheme instead of a standard network-based URI, an attacker can redirect all subsequent Matrix session requests from remote server endpoints to local filesystem resources on the victim's machine. This redirection bypasses normal network security controls and grants the application direct access to read or potentially write files depending on the specific request type and operating system permissions. The vulnerability exploits the trust relationship established during authentication, turning a standard configuration step into an attack vector for data exfiltration.
The operational impact of this vulnerability is particularly severe on Microsoft Windows systems due to how NTLM authentication handles credential transmission over file shares. When Thunderbird attempts to access resources via a file: URL that points to a network share controlled by the attacker, it may trigger automatic NTLM authentication mechanisms inherent in the Windows operating system and application stack. This process results in the leakage of the user's NTLM hash or plaintext credentials if configured improperly, as these credentials are transmitted to the unauthorized server endpoint disguised as part of legitimate Matrix traffic. Consequently, an attacker can capture these credentials to perform pass-the-hash attacks or further lateral movement within a corporate network, leading to significant compromise of user identity and potentially broader organizational security.
It is important to note that this specific credential leakage vector via NTLM over file shares is exclusive to the Windows platform due to its unique authentication subsystems; other operating systems such as Linux and macOS are not affected by this particular exploitation path because they do not utilize NTLM in the same manner for local or network resource access. Despite this platform specificity, the underlying flaw of accepting unvalidated URI schemes remains a risk across all platforms, potentially leading to unauthorized file reads on any system where Thunderbird is installed. The vulnerability was addressed and patched in Thunderbird versions 159 and 153.6, which implement stricter validation logic for homeserver addresses received during authentication.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation, as the application failed to verify that the input met expected criteria before processing it. Furthermore, the exploitation technique relates to ATT&CK tactic T1557 Adversary-in-the-Middle and specifically sub-techniques involving credential harvesting through protocol manipulation or trusted service impersonation. To mitigate such risks in similar environments, organizations should ensure all clients are updated to patched versions that enforce strict URI scheme validation. Additionally, security teams should monitor for unusual authentication patterns from Matrix servers and consider implementing network-level controls that restrict outbound connections to unauthorized file shares or local resources where feasible.