User Impersonation Flaw in ProcessOne's ejabberd Server
CVE-2026-104733

7.4HIGH

Key Information:

Vendor

Processone

Status
Ejabberd
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104733?

An issue has been identified in ProcessOne's ejabberd server, where an attacker can exploit an unvalidated authzid parameter in the SASL-PLAIN authentication mechanism. This vulnerability enables the attacker to impersonate any user on the server, potentially leading to unauthorized access or action under the guise of a legitimate user. It is crucial for users of ejabberd versions up to 26.04 to address this issue promptly to prevent exploitation.

Affected Version(s)

ejabberd MacOS 0 <= 26.04

References

https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-...
third-party-advisory
https://github.com/processone/ejabberd/releases#release-2...
release-notes

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marius Schwarz (NSIDE ATTACK LOGIC GmbH)
.