CVE-2026-95848
Received Received - Intake

Authentication Bypass in Moquette MQTT Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95848
EUVD
EUVD-2026-85418

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moquette moquette 0.18.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Moquette MQTT broker before version 0.18.1. When a configured authenticator or authorizator class fails to load due to issues like misspelled names or missing dependencies, the system silently falls back to permissive defaults (AcceptAllAuthenticator or PermitAllAuthorizatorPolicy). This means authentication and authorization are disabled without warning, allowing all clients to connect even if security was intended to be enforced.

Detection Guidance

Check Moquette broker startup logs for errors related to class loading failures for configured authenticator or authorizator classes. Look for messages indicating fallback to default permissive policies or failures to load specific classes.

Impact Analysis

If you use Moquette versions before 0.18.1, an attacker could exploit this to bypass authentication and authorization controls. This would allow unauthorized access to the MQTT broker, potentially leading to data breaches, unauthorized message publishing or subscribing, or compromise of connected systems relying on the broker for secure communication.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations requiring strict access controls and data protection. By allowing unauthorized access, it risks violating confidentiality requirements, data integrity, and audit logging obligations, potentially resulting in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later to ensure the broker fails to start if configured security classes cannot be loaded. Verify all configured authenticator and authorizator class names and dependencies are correct before starting the broker.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart