PT-2026-127209
CVE-2026-118180
·
Published
2026-10-27
·
Updated
2026-10-29
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 153.6
Thunderbird versions prior to 159
Description
Thunderbird fails to validate the homeserver address received in the login response during Matrix account authentication. A compromised or malicious homeserver can provide a
file: URL, redirecting subsequent session requests to local files. On Windows systems, this can be used to redirect requests to an attacker-controlled network share, leading to the leak of the user's NTLM (New Technology LAN Manager) credentials, which is a suite of security protocols used for authentication.Recommendations
Update to version 153.6.
Update to version 159.
Found an issue in the description? Have something to add? Feel free to write us 👾