CVE-2026-115748
Deferred Deferred - Pending Action

Authorization Bypass in Apache Vysper XMPP Server

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description
**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115748
EUVD
EUVD-2026-109916

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Vysper 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Apache Vysper, an XMPP (Jabber) server library. The issue affects all versions and stems from a missing authentication check in the XEP-0077 (In-Band Registration) implementation. This allows any authenticated user to compromise other accounts.

Detection Guidance

Since Apache Vysper is unsupported and no longer maintained, detection may involve checking for running instances of the software. Commands like 'ps aux | grep vysper' or 'netstat -tulnp | grep 5222' (default XMPP port) can help identify active services.

Impact Analysis

An attacker could exploit this to gain unauthorized access to other user accounts on the XMPP server. This could lead to data breaches, unauthorized actions, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Immediately stop using Apache Vysper and migrate to a supported XMPP server. Disable the service if running and remove it from your systems to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart