Apache Vysper authorization bypass lets users compromise accounts
Original title: CVE-2026-115748: Apache Vysper: Authorization bypass
Every Vysper version lacks an XEP-0077 authentication check; Apache rates it important at CVSS 8.8 and unsupported when assigned.
Thomas Wolf reported CVE-2026-115748 in Apache Vysper, an XMPP server library. All versions omit an authentication check in the XEP-0077 In-Band Registration implementation, so any authenticated user can compromise other accounts. Apache scores it CVSS 3.1 8.8 and marks it unsupported when assigned. The notice is cut off before stating a fix.
Unconfirmed: The notice is truncated before any remediation or exploitation status.
- CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
- A low-privileged authenticated user is enough; no user interaction is required.
- Apache lists every Vysper version as affected.
- The flaw was unsupported when the CVE was assigned.
Impact: Authenticated users can compromise other accounts
| Product | Affected |
|---|---|
| Apache Vysper | all versions |
- CVEs
- CVE-2026-115748
- Vendors
- Apache
- Products
- Apache Vysper
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115748 | Authorization bypass in Apache Vysper In-Band Registration | 8.8 | — |
From the original article
Posted by Thomas Wolf on Oct 23 Severity: important CVSS 3. 1: 8. 8 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.