Thunderbird’s Exchange AutoDiscover lookup transmits the user’s account credentials over plain HTTP when querying the domain’s AutoDiscover service. The bug causes the request to carry the password in clear text, allowing a network attacker who can observe that traffic to capture the user’s sensitive credentials. This flaw results in direct information disclosure of authentication data.

Mozilla Thunderbird versions up to and including 158.0 are affected. The affected version range is inferred from the fact that the issue was fixed in Thunderbird 158.0.1 and 153.5.1. Mozilla identified the fix in Thunderbird 158.0.1, after which the AutoDiscover lookup is performed securely and the credentials are no longer sent in clear text.

The vulnerability is exploitable by any entity that can intercept network traffic to the victim’s network or to the target domain’s AutoDiscover endpoint. While no EPSS score is available and the issue is not listed in the CISA KEV catalog, the risk remains significant because credential leakage can lead to unauthorized account access. The attack vector is network-based and does not require privileged access or user interaction beyond normal account setup.