CVE-2026-104733

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104733
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104733.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104733
Downstream
Published
2026-10-02T12:19:10Z
Modified
2026-10-21T02:54:32Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H/E:P CVSS Calculator
Summary
User Impersonation/Authorization Bypass in XMPP Server ejabberd
Details

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

Database specific 
{
    "cna_assigner":  "NCSC.ch",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104733.json"
}
References

Affected packages

Git / github.com/processone/ejabberd

Affected ranges

Type
GIT
Repo
https://github.com/processone/ejabberd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
413e7faee111028b7630523db82f7812ae285261
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "26.07"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "ChangesAt"
        }
    ]
}

Affected versions

13.*
13.03-beta1
13.06
13.09
13.10
13.12
14.*
14.05
14.07
14.12
15.*
15.02
15.03
15.04
15.06
15.07
15.09
16.*
16.01
16.02
16.03
16.04
16.06
16.08
16.09
16.12
17.*
17.01
17.03
17.03-beta
17.04
17.06
17.06-beta
17.07
17.08
17.09
17.11
17.12
18.*
18.01
18.03
18.04
18.06
18.09
18.12
19.*
19.02
19.05
19.08
19.09
20.*
20.01
20.02
20.03
20.04
20.07
20.12
21.*
21.01
21.04
21.07
21.12
22.*
22.05
22.10
23.*
23.01
23.04
23.10
24.*
24.02
24.06
24.07
24.10
24.12
25.*
25.03
25.04
25.07
25.08
25.10
26.*
26.01
26.02
26.03
26.04
v2.*
v2.1.10
v2.1.11
v2.1.12
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104733.json"