CVE-2026-113866

A flaw was found in Thunderbird. An information disclosure issue occurs during account setup when the Exchange AutoDiscover feature transmits requests over unencrypted Hypertext Transfer Protocol (HTTP). A network attacker monitoring traffic can intercept these plaintext requests, exposing the user's entered credentials and leading to unauthorized account access.

This vulnerability is rated as having Moderate impact by Red Hat because credential exposure is restricted to the initial account setup phase for Exchange mailboxes, rather than affecting ongoing mail communication. Exploitation requires an attacker to be positioned on the local network path to eavesdrop on unencrypted traffic while a user performs automated configuration. Pre-existing email profiles and accounts configured for standard IMAP or POP3 protocols are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.