The vulnerability is a flaw in the mod_proxy65 module of Prosody that mishandles access control when the module is activated. As a result, unauthenticated users can relay traffic through the server, allowing them to forward messages or data without performing any authentication. This abuse of privilege can be used to conceal malicious traffic, proxy users, or perform denial of service by exhausting bandwidth or server resources. The weakness is identified as CWE‑420, indicating improper use of privileged access. The impact therefore consists of potential data exfiltration, anonymity, or overload of the server via unauthenticated traffic

Prosody installations running version 0.12.0 to 0.12.5, or any release from 1.0.0 up to 13.0.4 with the mod_proxy65 module enabled, are affected. Versions 0.12.6 and all releases from 13.0.5 onward contain the fix and are not vulnerable

The CVSS score of 6.5 reflects moderate severity. Because no EPSS score is available and the vulnerability is not listed in CISA KEV, exploitation believed to be low to moderate. The vulnerability can be triggered over the network by connecting to the Prosody service with mod_proxy65 enabled, without any authentication. No publicly known exploits are documented, but an attacker could leverage the server as an open relay to forward traffic to arbitrary destinations.