Critical · published July 23, 2025
🚨 A simple mistake in handling URLs could expose your username and password! This critical vulnerability in Firefox and Thunderbird leaves sensitive HTTP Basic Authentication credentials vulnerable to prying eyes. 🔥 Think of it like sending a postcard where the sender's address is visible to anyone handling it — all your private info just hanging out there! Without the right protections, anyone could intercept those credentials in the wayward reports. An attacker could potentially capture your HTTP Basic Authentication credentials, allowing them to impersonate you and gain unauthorized access to sensitive resources. This is a serious breach that could compromise personal accounts and organizational data alike, leaving users vulnerable to phishing attacks or worse.
Think of it like sending a postcard where the sender's address is visible to anyone handling it — all your private info just hanging out there! Without the right protections, anyone could intercept those credentials in the wayward reports. This vulnerability arises because the `username:password` component of URLs was not properly stripped from Content Security Policy (CSP) reports, leading to the unintentional exposure of sensitive authentication details.
An attacker could potentially capture your HTTP Basic Authentication credentials, allowing them to impersonate you and gain unauthorized access to sensitive resources. This is a serious breach that could compromise personal accounts and organizational data alike, leaving users vulnerable to phishing attacks or worse. To mitigate this risk, update Firefox to version 141 or later, and Thunderbird to version 141 or later. Ensure all users are on these secure versions to protect against potential leaks of sensitive credentials. 🔒 You've got this! By updating your software, you'll be warding off this threat in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 128.13.0 | 128.13.0 |
| mozilla/firefox | < 141.0 | 141.0 |
| mozilla/firefox | ≥ 140.0, < 140.1.0 | 140.1.0 |
| mozilla/thunderbird | < 128.13.0 | 128.13.0 |
| mozilla/thunderbird | < 141.0 | 141.0 |
| mozilla/thunderbird | ≥ 140.0, < 140.1.0 | 140.1.0 |