CVE-2026-113866

5.9 Moyenne

Publiée le 20/10/2026 à 22:17 · Modifiée le 20/10/2026 à 22:17 · Reçue · Source : security@mozilla.org

Description

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Traduire en français

Produits concernés

Mozilla Thunderbird

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.9 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-523

Références

https://bugzilla.mozilla.org/show_bug.cgi?id=2080121
https://www.mozilla.org/security/advisories/mfsa2026-114/
https://www.mozilla.org/security/advisories/mfsa2026-115/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories