Authorization Bypass in Apache Vysper XMPP Server Library
CVE-2026-115748

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Vysper
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115748?

Apache Vysper, an XMPP (Jabber) server library, exposes a significant vulnerability due to a lack of authentication checks in its implementation of XEP-0077 (In-Band Registration). This oversight permits any authenticated user to access and potentially compromise other user accounts. As the Apache Vysper project is retired, no future updates or fixes will be provided. Users are highly encouraged to migrate to alternative solutions to avoid exposure to this security issue.

Affected Version(s)

Apache Vysper 0

References

https://mina.apache.org/vysper-project/
https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ho1aAs <xxy010605@gmail.com>
.