MSFA-2020-0001 (Pending CVE):
If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker.
This issue was resolved and addressed in
GLSA 202007-09 at https://security.gentoo.org/glsa/202007-09
by GLSA coordinator Sam James (sam_c).