CVE-2026-95848CWE-636

CVE-2026-95848

Critical · published September 23, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-636 · Not Failing Securely ('Failing Open')
Published
2026-09-23T21:17Z
Affected products (1)
ProductVersionsFixed in
moquette/moquette< 0.18.10.18.1
References (5)
https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007 · [email protected]https://github.com/moquette-io/moquette/pull/967 · [email protected]https://github.com/moquette-io/moquette/releases/tag/v0.18.1 · [email protected]https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq · [email protected]https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 23 SEP 16:29Z
    Moquette fails open when configured authentication or authorization classes cannot load
    cvelistv5