Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113866 Overview
CVE-2026-113866 affects Mozilla Thunderbird's Exchange AutoDiscover account setup flow. During account configuration, Thunderbird queried the domain's AutoDiscover service over plain HTTP in addition to HTTPS. A bug caused the unencrypted request to include the credentials the user had entered. A network attacker positioned between the client and the target domain could capture the user's password in cleartext. Mozilla fixed the issue in Thunderbird 158.0.1 and Thunderbird 153.5.1. The weakness is classified as [CWE-523]: Unprotected Transport of Credentials.
Critical Impact
A passive or active network attacker on the path between a Thunderbird client and the target mail domain could intercept Exchange account credentials transmitted in plaintext during AutoDiscover.
Affected Products
- Mozilla Thunderbird prior to 158.0.1
- Mozilla Thunderbird 153.x prior to 153.5.1
- Thunderbird deployments configured for Microsoft Exchange account setup
Discovery Timeline
- 2026-10-20 - CVE-2026-113866 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-113866
Vulnerability Analysis
Thunderbird's Exchange account setup relies on the Microsoft AutoDiscover protocol to locate server settings for a given email domain. The client typically probes several well-known URLs derived from the domain to retrieve XML configuration data. Thunderbird's implementation issued an AutoDiscover request over plain HTTP in parallel with the secure variants. Due to the bug tracked in Mozilla Bugzilla #2080121, that plaintext HTTP request carried the credentials the user supplied during account setup. An attacker on the same network segment, an upstream router, or any point along the path could read the password from the wire. The flaw does not require user interaction beyond initiating account setup and does not require prior privileges on the target system.
Root Cause
The root cause is improper transport selection for authenticated requests. Credentials intended for an authenticated HTTPS endpoint were attached to a request issued over cleartext HTTP, violating the principle that secrets must only traverse confidential channels. This matches [CWE-523], Unprotected Transport of Credentials.
Attack Vector
Exploitation requires a network attacker in a position to observe or intercept HTTP traffic between the victim's Thunderbird client and the AutoDiscover endpoint for the user's email domain. Suitable positions include shared Wi-Fi networks, compromised routers, ISP-level interception, and on-path attackers inside enterprise segments. The attacker passively captures the HTTP request body or headers and extracts the credentials. No exploit code is required because the vulnerability exposes the password directly in observable traffic. Public exploitation and CISA KEV listing have not been reported.
No verified proof-of-concept code is available. Refer to the Mozilla Bug Report #2080121 for technical details.
Detection Methods for CVE-2026-113866
Indicators of Compromise
- Outbound HTTP (TCP/80) requests from Thunderbird clients to hostnames beginning with autodiscover. for the user's mail domain.
- HTTP POST or GET traffic to /autodiscover/autodiscover.xml paths carrying Authorization: Basic headers or XML bodies containing user credentials.
- Thunderbird User-Agent strings in cleartext HTTP flows during the window when users configured Exchange accounts.
Detection Strategies
- Inspect proxy, firewall, and NetFlow logs for Thunderbird clients communicating with AutoDiscover endpoints over port 80 rather than 443.
- Correlate account setup activity with any HTTP requests containing basic authentication headers destined for mail infrastructure.
- Hunt in historical packet capture or decrypted TLS inspection data for AutoDiscover XML bodies accompanied by plaintext credentials.
Monitoring Recommendations
- Alert on any cleartext HTTP traffic to AutoDiscover hostnames from endpoints running vulnerable Thunderbird versions.
- Monitor help desk tickets and endpoint inventory for Thunderbird builds older than 158.0.1 or 153.5.1 and prioritize them for upgrade.
- Force rotation of Exchange passwords for users who configured accounts from untrusted networks before patching.
How to Mitigate CVE-2026-113866
Immediate Actions Required
- Upgrade all Thunderbird installations to version 158.0.1, 153.5.1, or later.
- Rotate Exchange and domain credentials for users who added accounts in Thunderbird on untrusted networks prior to patching.
- Restrict outbound TCP/80 traffic to AutoDiscover hostnames at the perimeter until all clients are patched.
Patch Information
Mozilla addressed the issue in Thunderbird 158.0.1 and Thunderbird 153.5.1. Details are published in Mozilla Security Advisory MFSA-2026-114 and Mozilla Security Advisory MFSA-2026-115. The underlying code change is tracked in Mozilla Bug Report #2080121.
Workarounds
- Instruct users to perform Exchange account setup only from trusted, encrypted network segments until clients are patched.
- Configure Exchange servers and reverse proxies to redirect HTTP AutoDiscover requests to HTTPS or reject them outright.
- Deploy enterprise policies that pre-populate Exchange server settings so Thunderbird does not invoke AutoDiscover during account creation.
# Example: block cleartext AutoDiscover egress at a Linux gateway
iptables -A FORWARD -p tcp --dport 80 \
-m string --string "autodiscover" --algo bm \
-j REJECT --reject-with tcp-reset
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
