CVE-2026-126136
OAuth2 access token could be sent over an unencrypted connection with Exchange accounts
Description
For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160.
INFO
Published Date :
Nov. 10, 2026, 6:59 p.m.
Last Modified :
Nov. 10, 2026, 6:59 p.m.
Remotely Exploit :
No
Source :
mozilla
Solution
- Update Thunderbird to version 160 or later.
- Ensure EWS/Graph connections use HTTPS.
- Review account configuration for secure protocols.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-126136 vulnerability anywhere in the article.