What’s Vulnerable › Vulnerabilities

CVE-2026-104733: User Impersonation/Authorization Bypass in XMPP Server ejabberd

• Severity: high (CVSS 7.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-02 · updated 2026-10-02
• Weakness: CWE-290

Description

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

Affected products

• ProcessOne ejabberd: through 26.04

References

• https://github.com/processone/ejabberd/releases#release-26.07
• https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-004/

Get alerted when CVE-2026-104733 or the next vulnerability affects your stack