Cyber ·
CVE-2026-115748: Apache Vysper authorization bypass in the XEP-0077 registration flow
Security advisory on an authentication flaw in the XEP-0077 in-band registration of Apache Vysper, rated important, with CVSS 3.1 score 8.8. Published on 23 October 2026 by Thomas Wolf on the oss-sec feed.
Apache Vysper is an XMPP (Jabber) server library. According to the advisory, its XEP-0077 in-band registration implementation lacks an authentication check, so any authenticated user can compromise other accounts. The severity is rated important, with CVSS 3.1 score 8.8 (high). The stated vector is network-based, with low complexity, low privileges and no user interaction, and high impact on confidentiality, integrity and availability. According to the source, all Apache Vysper versions are affected. The text states the project was unsupported when the CVE was assigned. The excerpt received is truncated and contains no fix or mitigation details, so we do not infer them here. For organizations running XMPP servers with this library, the advisory suggests inventorying instances and checking the versions in use. How to verify: consult the original link indicated in the source and the official record for CVE-2026-115748 before taking any decision. Rota Nacional does not patch, audit or inventory third-party servers. If your team uses AI to study this advisory, do not paste passwords, keys, logs with real user identifiers or customer e-mails. The personal data barrier helps protect information before a model runs, but it does not replace removing credentials.
Original source: CVE-2026-115748: Apache Vysper — bypass de autorização