Apache Vysper CVE-2026-115748

The attacker must hold a valid, authenticated account on the target Apache Vysper XMPP server (CVSS PR:L), and the server must expose the XEP-0077 In-Band Registration functionality whose handler is missing the authentication/authorization check. Given that, any authenticated user can act against other users' accounts to compromise them. The exploit is network-reachable and needs no victim interaction (AV:N, UI:N). The principal limiting factor is the authentication requirement - an attacker needs an account first - plus the fact that this affects only deployments still running the retired Vysper library; because all versions are affected and no patch will be released, the only vendor-stated remediation is migration to an alternative XMPP server.

The vendor-supplied CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high impact to confidentiality, integrity and availability. In practical terms PR:L means an attacker must already hold a valid account on the Vysper XMPP server, so this is an authenticated privilege-escalation/account-takeover issue rather than a fully unauthenticated RCE - the 'low privileges' barrier meaningfully narrows the attacker population to anyone who can register or has been issued an account. No EPSS probability is supplied and the vuln.today decision label is 'awaiting_data', so there is no quantitative exploitation forecast to weigh. There is no CISA KEV listing and no public PoC or exploit reference in the input, so exploitation status is: no public exploit identified at time of analysis. The dominant risk-reducing factor is not the technical signals but the product status: Apache Vysper is retired/dormant, the ASF will not ship a fix, and users are told to migrate. The net picture is a genuinely high-severity flaw (account compromise against any other user) but almost certainly very low real-world exposure given the product's retirement and tiny deployment footprint - a high-CVSS issue whose practical priority is bounded by prevalence, not by the vector.

An attacker who holds any valid account on an Apache Vysper XMPP server sends a crafted XEP-0077 (In-Band Registration) request; because the registration handler is missing an authentication/authorization check, the request is accepted against another user's account, letting the attacker alter credentials and take over that account. No public exploit code is identified in the available data, and the attacker needs a pre-existing authenticated session (PR:L), but the low complexity (AC:L) means the request itself is straightforward to craft.