{"id":"CVE-2026-115748","title":"Apache Vysper: Authorization bypass","summary":"**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Apache Software Foundation","product":"org.apache.vysper:vysper","affected":["org.apache.vysper:vysper <= *"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:34:11.951Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115748","references":[{"url":"https://mina.apache.org/vysper-project/"},{"url":"https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy4lh5yrsw8wsj"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.502Z","slug":"CVE-2026-115748","body":"## Overview\n\n**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.\n\n## Affected\n\n- `org.apache.vysper:vysper <= *`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}