CVE-2026-43504
Proxy65 Relay Misconfiguration in Prosody
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| prosody | prosody | to 0.12.6 (exc) |
| prosody | prosody | From 13.0.0 (inc) to 13.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in Prosody versions before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 when the mod_proxy65 module is enabled.
The issue arises because mod_proxy65 mishandles access control in a paused scenario, which allows relaying of unauthenticated traffic.
How can this vulnerability impact me? :
The vulnerability can allow unauthenticated traffic to be relayed through the affected Prosody server.
This could lead to unauthorized use of the server for relaying traffic, potentially resulting in information leakage or abuse of the server's resources.
The CVSS score of 6.5 indicates a medium severity impact, with potential integrity and availability impacts.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or detailed detection methods for identifying this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability involving mod_proxy65 in Prosody, you should upgrade to the fixed versions 0.12.6 or 13.0.5.
If mod_proxy65 is not needed, disable it to prevent unauthorized proxy usage.
Review and adjust firewall limits to restrict connection rates and reduce the risk of exploitation.