CVE-2026-104733 — User Impersonation/Authorization Bypass in XMPP Server ejabberd

CVE-2026-104733

User Impersonation/Authorization Bypass in XMPP Server ejabberd PUBLISHED

Description (CNA)

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

Affected (CNA)

Vendor / product	Versions
ProcessOne / ejabberd	affected 0 through 26.04

CWE

No CWE identifiers supplied.

References

https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-004/
https://github.com/processone/ejabberd/releases#release-26.07

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.