CVE-2026-115748

HighCVSS 8.8

Published: 26/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.61%

49th percentile - higher than 49% of all known CVEs

Summary

Apache Vysper, an XMPP (Jabber) server library, in all versions is missing an authentication check in its XEP-0077 (In-Band Registration) implementation. Any authenticated user can compromise other accounts. The project is retired and no fix will be released.

Risk Assessment

An authenticated user can take over other users' accounts, compromising communication confidentiality and integrity. Lack of vendor support means no future security fixes.

Recommendation

Users are recommended to find an alternative to Apache Vysper. Until migration, restrict in-band registration and monitor accounts.

Other vulnerabilities in Apache Vysper

CVE-2026-115721High
Apache Vysper, an XMPP (Jabber) server library, in all versions contains unbounded allocation in XML parsing, which may lead to an out-of-memory condition. The project is retired and no fix will be released.

Original NVD description (English source)

**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS