The flaw in Prosody’s mod_proxy65 module allows an unauthenticated XMPP client to relay traffic to a target XMPP server without proper access control. An attacker can send requests that are forwarded to another server and cause the relayed traffic to bypass authentication. This misuse can enable the attacker to transmit or intercept data, potentially compromising confidentiality or integrity of the XMPP sessions involved.

Prosody XMPP server is affected in all versions prior to 0.12.6 and in the 1.0.0 through 13.0.0 family prior to 13.0.5 when the mod_proxy65 module is enabled. Versions 0.12.6 and later or 13.0.5 and later receive the fix and are no longer vulnerable.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, so the actual exploitation probability is uncertain, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is remote; an unauthenticated client can target the XMPP proxy port exposed by mod_proxy65 and trigger the relay. Modest risk is obviated by prompt patching or disabling the module.