Thunderbird: update before adding an Exchange account
Mozilla has fixed credentials being sent over plain HTTP during Exchange account setup. Update to Thunderbird 158.0.1 or 153.5.1 for your branch. Other fixes cover XMPP and email authentication.
Getting started
Generated image · SecuFocus
At a glance
Key points
Update Thunderbird before setting up an Exchange account. Mozilla has released Thunderbird 158.0.1 and 153.5.1, fixing a server-discovery request that sent the credentials you entered without encryption. The described risk concerns that setup process, not every incoming message.
A discovery request included the password over plain HTTP
Mozilla advisories MFSA 2026-114 and 2026-115, published on October 20, describe CVE-2026-113866. While adding an Exchange account, Thunderbird also queried the domain’s AutoDiscover service over HTTP. A bug included the credentials the user had just entered in that unencrypted request, allowing a network attacker to obtain the password.
AutoDiscover finds the mail server’s settings. The flaw is in Thunderbird’s account-setup process. Updating the client does not patch an Exchange server, and the advisory does not say that every message you received transmitted your password.
XMPP and specific authentication methods have separate fixes
CVE-2026-113867 affects only the chat feature with XMPP accounts. Mozilla describes crafted requests that could send messages or change contact and subscription settings on the user’s behalf without their interaction.
CVE-2026-113868 concerns authentication to a malicious POP3 or SMTP server using NTLM or GSSAPI. The flaw can cause a crash; the described memory disclosure affects NTLM only. Those conditions matter: the advisory does not describe every POP3 or SMTP connection as leaking memory.
Both releases also include the block list for compromised intermediate eMudhra certificates, even when RemoteSettings is disabled or unavailable. Thunderbird 158.0.1 fixes additional components, including S/MIME decryption. The exact lists differ between the two advisories.
Check the client before resuming account setup
The versions to check are Thunderbird 158.0.1 or 153.5.1, depending on your installed branch. Use your installation’s normal update channel, restart the application and verify its version before adding the account. On a managed device, ask the administrator to confirm the fix rather than installing another copy from elsewhere.
If you already set up an Exchange account with an affected version, the advisory cannot tell you whether anyone captured your credentials. If you suspect this happened, explain the setup context to whoever manages the account and arrange a password change with them. A new password does not replace the Thunderbird update.
The advisories do not declare active exploitation of these mail-specific flaws. That does not prove no attacks have occurred. SecuFocus has read the bulletins without reproducing the vulnerabilities or checking an individual installation.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.