Moquette, a lightweight Java MQTT broker, contains a flaw where a failure to load a configured authenticator or authorizator class is silently ignored, causing the broker to fallback to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. This results in the broker starting with authentication or authorization disabled even though controls were requested, granting any user that can connect full, unauthenticated access. The weakness is categorized as CWE‑636.

The vulnerability affects the moquette-io Moquette broker. Versions prior to 0.18.1 are impacted. The issue was resolved in the 0.18.1 release and later versions.

The CVSS score of 9.3 indicates critical severity. EPSS is not reported and the vulnerability is not listed in CISA KEV. Attackers that can influence the broker’s classpath or configuration—such as by supplying a misspelled class name, omitting a dependency, or introducing a constructor failure—can trigger the fallback to a permissive policy. The likely attack vector is local configuration or tampering with the deployment environment, which allows an attacker to gain unauthenticated control once the broker is running.