The vulnerability CVE-2025-8031 involves improper handling of URLs in CSP reports by Mozilla Firefox, where the username:password segment was not correctly removed. This could lead to leakage of HTTP Basic Authentication credentials through CSP reports. The issue affects Firefox versions prior to 141, Firefox ESR versions prior to 128.13 and 140.1, and Thunderbird versions prior to 141, 128.13, and 140.1. Mozilla released official security advisories (MFSA2025-56 and MFSA2025-58) confirming the fix in Firefox 141 and ESR 128.13. The CVSS v3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could result in the unintended disclosure of HTTP Basic Authentication credentials via CSP reports, potentially compromising user credentials. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported to date.

Mozilla has released official fixes for this vulnerability in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. Users and administrators should update affected products to these fixed versions or later to remediate this issue. Patch status is confirmed by Mozilla advisories. No additional mitigation actions are required beyond applying these official updates.