Mozilla fixed an Exchange account setup flaw in Thunderbird 153.5.1. During server discovery, Thunderbird could send an HTTP request containing the password entered by the user. An attacker able to intercept traffic between the user and the server could then capture that secret.
The scenario is specific: it concerns setting up an Exchange account with a vulnerable version, not every time a user opens or receives email. Mozilla's security advisory rates the issue as high impact and published the fix on October 20. It does not report known exploitation or a password that was actually stolen.
When the password could have been exposed
Tracked as CVE-2026-113866, the flaw concerns the AutoDiscover request used while setting up a Microsoft Exchange account. That request could use HTTP and include the credentials entered in the setup assistant.
For a third party to capture the password, they would have needed to observe or intercept that network traffic. The advisory does not say that passwords for every Exchange account configured in Thunderbird were sent to an attacker. A technical possibility should not be confused with a confirmed compromise.
Update Thunderbird
Mozilla fixed the flaw in Thunderbird 153.5.1. Install that version or a later one through your organization's update channel, then check the version shown in About Thunderbird. For managed computers, ask IT to confirm that the fixed release is deployed on affected devices.
If the update is not yet available through your usual channel, avoid setting up new Exchange accounts on a vulnerable version over a shared or untrusted network. Do not download an installer from a third-party site.
Should you change your credentials?
Mozilla does not report known exploitation in its advisory. Without another indicator, updating the software is the useful first step; changing every password is not an automatic consequence of this bulletin.
If an Exchange account was set up before the fix on a network accessible to others, and your logs or circumstances suggest interception, contact your email administrator. If a reset is warranted, change the password from a trusted device and network, then review sessions and authentication methods under your organization's process.
Limit the impact of a reused secret
If the Exchange password is also used for other services, consider changing it there too. Use a different secret for each account so a possible exposure does not unlock several business tools. Your account administrator can also review multifactor authentication rules and active sessions.
Updating Thunderbird protects against this specific flaw; it does not replace account monitoring or your organization's email security practices. Preserve information needed for analysis and follow your incident response process if unusual activity appears.
How this relates to Soclyde
Unique passwords limit the impact of an exposure, but they still need to be easy to retrieve and share with the right people. Soclyde lets teams keep business credentials in an encrypted vault available on authorized devices.
Soclyde does not fix Thunderbird, secure the Exchange connection or determine whether a password was intercepted. Updates and account reviews still need to happen in your organization's email tools.
Key takeaway
Install Thunderbird 153.5.1 or later, and do not infer account theft without evidence specific to your situation. The vulnerability describes possible exposure during Exchange setup if network traffic is intercepted. To organize business credentials, read our guide to securing passwords.
