CVE-2026-113867

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

• https://bugzilla.mozilla.org/show_bug.cgi?id=2080073
• https://www.mozilla.org/security/advisories/mfsa2026-114/
• https://www.mozilla.org/security/advisories/mfsa2026-115/

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113810A Stored Cross-Site Scripting vulnerability exists in the SN…7
• CVE-2026-113811Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 fo…
• CVE-2026-113812Mozilla::CA versions before 20261020 for Perl provide a CA c…
• CVE-2026-11383IBM Tivoli System Automation Application Manager 4.1 and IBM…5.4
• CVE-2026-11386An input validation and injection vulnerability exists in Ca…9
• CVE-2026-113866When setting up an account, Thunderbird's Exchange AutoDisco…5.9
• CVE-2026-113868When authenticating to a POP3 or SMTP server using NTLM, Thu…5.3
• CVE-2026-113869When Thunderbird asked for a security device password (for e…5.4
• CVE-2026-11387The SMS Alert – SMS & OTP for WooCommerce, Order Notificatio…9.8
• CVE-2026-113870MongoDB Compass improperly escapes certain BSON values when …8.8
• CVE-2026-11388Double Free vulnerability in RTI Connext Professional (Core …6.9
• CVE-2026-11389Out-of-bounds Read, Function Call With Incorrect Number of A…6.8