CVE-2025-8031CWE-276

CVE-2025-8031

Critical · published July 23, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

🚨 A simple mistake in handling URLs could expose your username and password! This critical vulnerability in Firefox and Thunderbird leaves sensitive HTTP Basic Authentication credentials vulnerable to prying eyes. 🔥 Think of it like sending a postcard where the sender's address is visible to anyone handling it — all your private info just hanging out there! Without the right protections, anyone could intercept those credentials in the wayward reports. An attacker could potentially capture your HTTP Basic Authentication credentials, allowing them to impersonate you and gain unauthorized access to sensitive resources. This is a serious breach that could compromise personal accounts and organizational data alike, leaving users vulnerable to phishing attacks or worse.

Put simply

Think of it like sending a postcard where the sender's address is visible to anyone handling it — all your private info just hanging out there! Without the right protections, anyone could intercept those credentials in the wayward reports. This vulnerability arises because the `username:password` component of URLs was not properly stripped from Content Security Policy (CSP) reports, leading to the unintentional exposure of sensitive authentication details.

What to do

An attacker could potentially capture your HTTP Basic Authentication credentials, allowing them to impersonate you and gain unauthorized access to sensitive resources. This is a serious breach that could compromise personal accounts and organizational data alike, leaving users vulnerable to phishing attacks or worse. To mitigate this risk, update Firefox to version 141 or later, and Thunderbird to version 141 or later. Ensure all users are on these secure versions to protect against potential leaks of sensitive credentials. 🔒 You've got this! By updating your software, you'll be warding off this threat in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00494 · 41.5th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-07-23T01:15Z
Affected products (6)
ProductVersionsFixed in
mozilla/firefox< 128.13.0128.13.0
mozilla/firefox< 141.0141.0
mozilla/firefox≥ 140.0, < 140.1.0140.1.0
mozilla/thunderbird< 128.13.0128.13.0
mozilla/thunderbird< 141.0141.0
mozilla/thunderbird≥ 140.0, < 140.1.0140.1.0
References (8)
EPSS history
Timeline
  • 22 JUL 20:49Z
    Incorrect URL stripping in CSP reports
    cvelistv5