Detections
Analytics
CVE-2025-8031
critical
Description
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
References
https://www.mozilla.org/security/advisories/mfsa2025-63/
https://www.mozilla.org/security/advisories/mfsa2025-62/
https://www.mozilla.org/security/advisories/mfsa2025-61/
https://www.mozilla.org/security/advisories/mfsa2025-59/
https://www.mozilla.org/security/advisories/mfsa2025-58/