---
id: CVE-2026-118180
title: >-
  Matrix homeserver could redirect the chat session to a local file or network
  share
summary: >-
  When logging in to a Matrix account, Thunderbird used the homeserver address
  provided in the server's login response without validating it. A malicious or
  compromised homeserver could provide a file: URL, causing Thunderbird to send
  all …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
vendor: Mozilla
product: Thunderbird
affected:
  - Thunderbird
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T16:42:09.260822Z'
published: '2026-10-27'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T16:42:46.853Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118180'
references:
  - url: 'https://bugzilla.mozilla.org/show_bug.cgi?id=2080939'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-121/'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-122/'
tags:
  - cve.org
epss: 0.00174
epssPercentile: 0.06912
ingestedAt: '2026-10-27T18:52:10.020Z'
---

## Overview

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

## Affected

- `Thunderbird`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.