CVE record · 1 source
CVE-2026-118180
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.
- Vendor
- Mozilla
- Product
- Thunderbird
- Exposure class
- Identity, Email
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to…