CVE-2026-43504

MEDIUM

Prosody <0.12.6, 1.0.0-13.0.0 <13.0.5 - Auth Bypass

Title source: llm
STIX 2.1

Description

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.

References (2)

Scores

CVSS v3 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
Prosody/Prosody < 0.12.6
Prosody/Prosody 1.0.0 - 13.0.5
Published May 01, 2026
Tracked Since May 01, 2026