CVE-2026-43505

MEDIUM

Prosody mod_proxy65 Unprotected Alternate Channel

Generated titleSource: EIP title enrichment
STIX 2.1 vulnerability

Record summary

CVE-2026-43505 has a selected CVSS score of 6.5 (medium).

Description

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 1, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Prosody

Browse Prosody / Prosody

Default status: unaffected

CVE ListBefore 0.12.6affected
1.0.0 to < 13.0.5affected

References

3