Authentication Bypass Vulnerability in Moquette MQTT Broker

CVE-2026-95848

What is CVE-2026-95848?

Moquette is a lightweight Java MQTT broker that faces a vulnerability related to its authentication and authorization mechanisms. Specifically, prior to version 0.18.1, if a configured authenticator or authorizer class fails to load due to issues such as a misspelled class name, missing dependency, constructor failure, or classpath issues, the server incorrectly reverts to default policies—AcceptAllAuthenticator and PermitAllAuthorizatorPolicy. This flaw could unintentionally disable crucial authentication controls, even when operators have explicitly configured them. This significant oversight is addressed in version 0.18.1 of the broker.

References