ProcessOne ejabberd CVE-2026-104733

Exploitation requires (1) the SASL-PLAIN authentication mechanism to be enabled/accepted by the ejabberd server, and (2) the attacker to possess valid credentials for at least one account (PR:L) to establish an authenticated session. Given those, the attacker supplies an arbitrary victim identity in the SASL authzid (authorization identity) parameter, which the server fails to validate against the authenticated user, granting impersonation of any user. Limiting factors: a valid account is mandatory (no fully unauthenticated path), and the mechanism applies to SASL-PLAIN specifically - deployments that disable PLAIN or enforce authzid=authcid binding would not be exploitable. Affects ejabberd versions 0 through 26.04.

This is a credentialed authentication/authorization flaw rather than a fully unauthenticated takeover. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation that nonetheless requires the attacker to already hold a valid low-privilege account (PR:L) to open an authenticated SASL-PLAIN session - so it is not drive-by remote code execution but a privilege/identity-escalation issue usable by any legitimate user or anyone able to obtain a single account. The exploit maturity metric E:P signals a proof-of-concept stage, consistent with the NSIDE advisory reference, so publicly available exploit code exists but there is no CISA KEV listing and no EPSS value supplied, meaning there is no evidence of widespread active exploitation at this time. The impact metrics are high (VC:H/VI:H and subsequent-system SC:H/SI:H/SA:H), reflecting that impersonating arbitrary users - including potentially administrators - breaks the server's entire identity model. Net assessment: a genuine high-priority issue for any multi-tenant/federated ejabberd deployment because the privilege barrier (one valid account) is low and the blast radius is total account impersonation, but it is a notch below the worst-case because PR:L is required rather than PR:N. Note one discrepancy to verify: the input Tags label this 'Information Disclosure,' whereas the description describes user impersonation (improper authorization), which also enables integrity actions (sending messages as a victim), not merely disclosure.

An attacker who holds (or registers) a single low-privilege ejabberd account authenticates using the SASL-PLAIN mechanism and sets the authzid (authorization identity) field to a targeted victim's JID; because the server fails to validate that the authenticated identity is permitted to act as the authzid, the attacker is logged in and acts as the impersonated user. A proof-of-concept is referenced in the NSIDE advisory, and because attack complexity is low this can be performed with a trivially modified XMPP client once valid credentials are available.