CVE-2025-4088

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

• CWE-352

• https://bugzilla.mozilla.org/show_bug.cgi?id=1953521Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2025-28/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2025-31/Vendor Advisory

Published

Apr 29, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40842Ericsson Indoor Connect 8855 versions prior to 2025.Q3 conta…6.1
• CVE-2025-40843CodeChecker is an analyzer tooling, defect database and view…7.8
• CVE-2025-40846Improper Input Validation, the returnUrl parameter in Accoun…7.1
• CVE-2025-4085An attacker with control over a content process could potent…7.1
• CVE-2025-4086A specially crafted filename containing a large number of en…6.5
• CVE-2025-4087A vulnerability was identified in Thunderbird where XPath pa…4.8
• CVE-2025-40885A SQL Injection vulnerability was discovered in the Smart Po…6.5
• CVE-2025-40886A SQL Injection vulnerability was discovered in the Alert fu…8.8
• CVE-2025-40887A SQL Injection vulnerability was discovered in the Alert fu…6.5
• CVE-2025-40888A SQL Injection vulnerability was discovered in the CLI func…6.5
• CVE-2025-40889A path traversal vulnerability was discovered in the Time Ma…8.1
• CVE-2025-4089Due to insufficient escaping of special characters in the "c…5.1