CVE-2026-113866

5.9 MEDIUM

Published 2026-10-20 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-523

All references

https://bugzilla.mozilla.org/show_bug.cgi?id=2080121
https://www.mozilla.org/security/advisories/mfsa2026-114/
https://www.mozilla.org/security/advisories/mfsa2026-115/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-17620

Related by shared AI tags and CWE weakness class. Browse the full archive.