---
id: "CVE-2026-115748"
kind: "vulnerability"
aliases: ["CVE-2026-115748"]
title: "Apache Vysper: missing check in XMPP registration lets users take over accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "self-hosted", "xmpp"]
not_affected_if: ["vysper-not-used"]
published_at: "2026-10-26T16:17:17+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:32:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115748", "first_seen_at": "2026-10-26T16:31:01+00:00"}]
---

# Apache Vysper: missing check in XMPP registration lets users take over accounts

Apache Vysper, an XMPP server library, has an in-band registration (XEP-0077) implementation that skips an authentication check. Any logged-in user can change or compromise other accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on Apache Vysper, for example by searching build files for `vysper` or `org.apache.vysper`
- Confirm whether in-band registration is enabled on your XMPP server

## Fix

- No fixed version exists: the project is retired and the sources say no fix will be released
- Move to an alternative XMPP server or library

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115748

## From the sources

**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.




Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.




As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_