Apache Vysper authorization bypass lets users compromise accounts
Every Vysper version lacks an XEP-0077 authentication check; Apache rates it important at CVSS 8.8 and unsupported when assigned.
46
CVE-2026-115748
Authorization bypass in Apache Vysper In-Band Registration
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Vysper, an XMPP (Jabber) server library, has an authorization bypass in its XEP-0077 In-Band Registration implementation, in all versions. The path is missing an authentication check, so any authenticated user can compromise other accounts over the network with no further user interaction. The project is retired and Apache does not plan a fix. Operators still running Vysper are affected.
What to do: Apache will not release a fix for CVE-2026-115748 because Vysper is retired. Find an alternative, as Apache recommends.
| Product | Affected |
|---|---|
| Apache Vysper | all versions |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
- Weakness
- CWE-639
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H