This vulnerability is an authorization bypass in Apache Vysper’s XEP-0077 (In‑Band Registration) implementation. The library’s handling of this XMPP extension omits an essential authentication check, allowing any authenticated user to act on behalf of any other account. The result is that an attacker who compromises or obtains valid credentials can impersonate or modify other users, leading to unauthorized data access, manipulation, or impersonation. The weakness is classified as CWE-639.

All versions of Apache Vysper, a retired XMPP server library maintained by the Apache Software Foundation, are affected. No security updates are forthcoming, and the project has been retired.

With a CVSS score of 8.8 this issue represents a high‑severity privilege escalation risk. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the server, which could be achieved through normal access or credential compromise. Once authenticated, the attacker can impersonate other accounts without any additional authentication step. Given the lack of a vendor patch, the risk remains high for any deployments still using Vysper.