Mozilla Thunderbird EUVD-2026-105293

Exploitation requires three concrete conditions: (1) the victim is configuring an Exchange/Microsoft email account in Thunderbird via the AutoDiscover mechanism (the flaw is specific to the Exchange AutoDiscover lookup path, not generic IMAP/POP setup); (2) the attacker holds a man-in-the-middle or on-path position able to observe the plaintext HTTP AutoDiscover request at the moment of setup; and (3) the account-setup credential-entry step actively occurs - the password only traverses the wire during this transient window, not during normal mail operation. Limiting factors: exploitation is confined to the one-time account-creation event (no persistent exposure), requires the attacker to already control the network path (hence CVSS AC:H), affects Thunderbird versions prior to 158.0.1, and yields credential disclosure only (no code execution or integrity/availability impact).

This is a genuine but moderate-priority credential-disclosure flaw, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) is internally consistent with the description: a network attacker (AV:N) with no privileges (PR:N) can capture a full password (C:H), but only by occupying a privileged man-in-the-middle position on the victim's network path during the brief account-setup window - which is exactly why complexity is High (AC:H). The SSVC framework reinforces a lower real-world urgency: Exploitation=none (no observed attacks), Automatable=no (an attacker cannot mass-exploit this; each hit requires a victim setting up an Exchange account on a path the attacker controls), and Technical Impact=partial. No EPSS score was provided, KEV status is NO, and no public exploit (POC) was identified in the input, so exploitation status is 'no public exploit identified at time of analysis.' One tension worth noting for defenders: the vector is AV:N/UI:N, yet the attack realistically depends on a victim voluntarily initiating account setup and entering credentials while the attacker is already positioned on the wire - so the AV:N/UI:N encoding understates the behavioral precondition even though it is technically defensible (the credential leak itself is automatic once setup begins). No conflicting severity signals, but note that absence of EPSS/KEV data is a gap, not evidence of safety.

An attacker who controls a network segment (shared/public Wi-Fi, a compromised router, or an on-path position) waits for a user to add an Exchange account in Thunderbird. When Thunderbird performs the AutoDiscover lookup, it also issues a plaintext HTTP request that erroneously carries the entered credentials, letting the attacker read the username and password off the wire. No public exploit code was identified, and the attacker must already hold a man-in-the-middle position during the one-time setup, limiting opportunistic use.