Live › vulnerability › CVE-2026-115748
Go to dashboardApache Vysper, an XMPP server library, has an in-band registration (XEP-0077) implementation that skips an authentication check. Any logged-in user can change or compromise other accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Teams running Apache Vysper as an XMPP server, where in-band registration is reachable by logged-in users. Deployments that do not use Vysper, or that do not expose the registration feature, have less exposure. The sources do not say which Vysper configurations enable the affected code path.
No product ranges from the sources yet.
vysper or org.apache.vysperEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
UNSUPPORTED WHEN ASSIGNED Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
This page as .md · .json · in your agent: get_signal("CVE-2026-115748")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.