Skip to main content

Prosody CVE-2026-43505

| EUVDEUVD-2026-26658 MEDIUM
Unprotected Alternate Channel (CWE-420)
2026-05-01 mitre
Information Disclosure Prosody
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

6
Patch released
May 01, 2026 - 17:15 nvd
Patch available
Patch available
May 01, 2026 - 16:33 EUVD
Analysis Generated
May 01, 2026 - 16:00 vuln.today
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26658
Analysis Generated
May 01, 2026 - 15:00 vuln.today
CVE Published
May 01, 2026 - 14:42 nvd
MEDIUM 6.5

DescriptionCVE.org

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

AnalysisAI

Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access control during SOCKS5 activation, resulting in integrity compromise and service disruption without requiring authentication. Affected versions are Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 when mod_proxy65 is enabled. CVSS 6.5 reflects medium severity with network-accessible attack surface, low complexity, and non-privileged unauthenticated access, though confirmed availability and integrity impact limits widespread severity.

Technical ContextAI

Prosody is an XMPP (Jabber) server written in Lua that includes the mod_proxy65 module, which implements SOCKS5 byte-stream proxy functionality per XEP-0065 for relay of client-to-client communications. The vulnerability resides in mod_proxy65's access control logic during the SOCKS5 activation handshake phase, where the module fails to properly validate and enforce authentication requirements before allowing traffic relaying. CWE-420 (Improper Input Validation) indicates the root cause is insufficient validation of access control preconditions, allowing unauthenticated SOCKS5 requests to proceed to the relay stage. This affects the CPE cpe:2.3:a:prosody:prosody:*:*:*:*:*:* across multiple versions.

RemediationAI

Upgrade immediately to Prosody 0.12.6 or Prosody 13.0.5 or later to apply the vendor-released patch that corrects mod_proxy65 access control validation. If immediate patching is not feasible, disable the mod_proxy65 module by removing or commenting out 'proxy65' from the modules_enabled table in prosody.cfg.lua and restarting the Prosody service; this eliminates the attack surface entirely but breaks SOCKS5 byte-stream proxy functionality for clients relying on direct peer-to-peer file transfer. Organizations dependent on mod_proxy65 should isolate SOCKS5 proxy traffic to trusted internal networks using firewall rules to restrict access to the proxy port (default 5000) to known XMPP clients and servers only. Comprehensive details and official patch availability are documented in the Prosody security advisory at https://prosody.im/security/advisory_735dd9d3/

More in Prosody

View all
CVE-2014-2744 HIGH POC
7.8 Apr 11

plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compr
CVE-2022-0217 HIGH POC
7.5 Aug 26

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML feat
CVE-2021-37601 HIGH POC
7.5 Jul 30

muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, me
CVE-2018-10847 HIGH
8.8 Jul 30

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Rated high severity (CVSS 8.8), this v
CVE-2014-2745 HIGH
7.8 Apr 11

Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers
CVE-2016-1232 HIGH
7.5 Jan 12

The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server
CVE-2021-32920 HIGH
7.5 May 13

Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. Rated high seve
CVE-2021-32919 HIGH
7.5 May 13

An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2021-32918 HIGH
7.5 May 13

An issue was discovered in Prosody before 0.11.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2026-43504 MEDIUM
6.5 May 01

Improper access control in Prosody's mod_proxy65 module allows unauthenticated relaying of traffic when the module enter
CVE-2016-1231 MEDIUM
5.9 Jan 12

Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows

CVE-2021-32921 MEDIUM
5.9 May 13

An issue was discovered in Prosody before 0.11.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely explo

Same weakness CWE-420 – Unprotected Alternate Channel

View all
CVE-2025-13315 CRITICAL POC
9.3
CVE-2023-20198 CRITICAL POC
10.0
CVE-2026-40217 HIGH POC
8.8
CVE-2020-8558 HIGH POC
8.8
CVE-2023-28840 HIGH POC
8.7
CVE-2025-67303 HIGH POC
7.5
CVE-2023-31241 CRITICAL
10.0
CVE-2025-52921 CRITICAL
9.9

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-43505 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy