CVE-2026-118180 Details
Description
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A vulnerability in Mozilla Thunderbird's handling of Matrix account logins allowed for improper validation of homeserver addresses. This flaw could be exploited by a malicious or compromised homeserver to redirect requests to local files or, on Windows, to an attacker-controlled network share. Such redirection could result in the leakage of NTLM credentials. The issue was present in Thunderbird versions prior to 159 and 153.6.
Users can upgrade to Thunderbird 159 or Thunderbird 153.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=2080939 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-121/ | [email protected] | AdvisoryBundleRemedyVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-122/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mozilla Thunderbird | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |