CVE-2025-8031

CriticalCVSS 9.8/10Last modified Oct 5, 2026

Description

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-80328.1XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, F CVE-2025-80336.5The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnera CVE-2025-80348.8Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Fire CVE-2025-80358.8Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderb CVE-2025-80368.1Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerabilit CVE-2025-80379.1Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the sha CVE-2025-80389.8Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140 CVE-2025-80398.1In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox CVE-2025-80408.8Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence CVE-2025-80415.3In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability wa CVE-2025-80429.8Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in F CVE-2025-80439.8Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.