Apache Vysper: Authorization bypass in XEP-0077 In-Band Registration
Summary
Apache Vysper, an XMPP (Jabber) server library, is missing an authentication check in its XEP-0077 In-Band Registration implementation. Any authenticated user can exploit this to compromise other accounts. The project is retired and no fix will be released.
Affected
- All versions of Apache Vysper (version range 0 to *).
Fixed in
- Unknown. The vendor does not plan to release a fixed version.
Workaround
- Disable XEP-0077 In-Band Registration or block inbound XMPP registration requests (third-party guidance, verify before use).
- Restrict Vysper to trusted internal networks until it is replaced.
Exploitation
- No evidence of exploitation in the wild.
- No public proof of concept found.
- Attack requires network access and a valid user account (CVSS:3.1 PR:L).
Our recommendation
- Check whether Vysper is in use, including Java applications embedding org.apache.vysper:vysper.
- Check whether account registration is open to the internet and close it.
- Disable in-band registration or restrict it to trusted networks as an interim step.
- Plan migration to a maintained XMPP server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/CVE record source: OpenCVE CVE-2026-115748 app.opencve.io
- Apache Vysper project page mina.apache.org
- Apache oss-security advisory www.openwall.com
- Apache vendor advisory thread lists.apache.org
- OffSeq threat radar CVE-2026-115748 radar.offseq.com
- VulDB CVE-2026-115748 entry vuldb.com
- XEP-0077 In-Band Registration specification xmpp.org
- Apache Vysper GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:32.
Original description (NVD)
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.