EUVD-2026-26657Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
6DescriptionCVE.org
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.
AnalysisAI
Improper access control in Prosody's mod_proxy65 module allows unauthenticated relaying of traffic when the module enters a paused state, enabling attackers to bypass authentication and impact data integrity and availability across affected versions. Prosody before 0.12.6 and versions 1.0.0 through 13.0.0 before 13.0.5 are vulnerable when mod_proxy65 is explicitly enabled; no public exploit code or active exploitation has been confirmed at time of analysis, though the network-accessible vulnerability with no authentication requirement and low complexity presents meaningful real-world risk.
Technical ContextAI
Prosody is an XMPP (Jabber) server written in Lua that uses modular architecture to extend functionality. The mod_proxy65 module implements XEP-0065 SOCKS5 bytestream proxying, a protocol mechanism allowing two XMPP clients to relay media through a trusted server when direct peer-to-peer connection is impossible. The vulnerability stems from CWE-863 (Incorrect Authorization), specifically improper state management: when mod_proxy65 transitions to a paused state (likely due to resource constraints, administrative action, or error conditions), the module fails to maintain proper access control checks, allowing unauthenticated traffic to traverse the proxy without verification. This creates an authentication bypass in a component that should enforce strict peer verification before relaying any traffic.
RemediationAI
Upgrade Prosody to version 0.12.6 or later (for 0.12.x branch) or version 13.0.5 or later (for 13.x branch); intermediate versions 1.0.0 through 13.0.4 require upgrade to the next available patched release in their respective branches. Vendor-released patches are available per advisory at https://prosody.im/security/advisory_735dd9d3/. If immediate patching is not feasible, disable the mod_proxy65 module by removing it from the enabled modules list in prosody.cfg.lua (set modules_enabled = { ... } to exclude 'proxy65') - this eliminates the attack surface entirely but removes XEP-0065 bytestream proxying functionality, affecting any clients or workflows requiring media relay through the server. Alternatively, restrict network access to the proxy65 port (default 5000) via firewall rules to limit exposure to trusted internal networks only, though this is a compensating control rather than a fix and does not resolve the underlying access control flaw. Test remediation by verifying XMPP connection logs show no unauthenticated proxy sessions after patching or disabling the module.
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compr
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML feat
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, me
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Rated high severity (CVSS 8.8), this v
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. Rated high seve
An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access cont
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows
An issue was discovered in Prosody before 0.11.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely explo
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today