---
id: CVE-2026-115748
title: 'Apache Vysper: Authorization bypass'
summary: "**UNSUPPORTED WHEN ASSIGNED**\_\_Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: Apache Software Foundation
product: 'org.apache.vysper:vysper'
affected:
  - 'org.apache.vysper:vysper <= *'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:34:11.951Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115748'
references:
  - url: 'https://mina.apache.org/vysper-project/'
  - url: 'https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy4lh5yrsw8wsj'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.502Z'
---

## Overview

**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.




Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

## Affected

- `org.apache.vysper:vysper <= *`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.