Security Flaw in Openfire's Client TLS Authentication Process

CVE-2025-59154

What is CVE-2025-59154?

Openfire, an open-source XMPP server, has a critical vulnerability in its SASL EXTERNAL mechanism for TLS client authentication. The issue arises in the handling of user identities extracted from X.509 certificates. Instead of correctly parsing structured ASN.1 data, the server improperly utilizes a method that fetches the Distinguished Name (DN) and applies a regular expression to identify the Common Name (CN). This method can allow a malicious actor to manipulate the contents of the CN, enabling them to impersonate another user if SASL EXTERNAL is enabled and configured to map CNs to user accounts. Remedial measures are included in Openfire versions 5.0.2 and 5.1.0.

References