CVE-2026-115748: Apache Vysper: Authorization bypass
Published Oct 23, 2026
·Updated
UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
Affected Software
1 affected component
Apache Vysper
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Find an alternative to Apache Vysper, which has no planned fix for the authorization bypass.
Event History
Oct 26, 2026
CVE Published
via MITRE·03:01 PM
Data Sourced
via MITRE·03:01 PM
DescriptionSeverityWeakness