Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Moquette broker may skip authentication if class fails

CVE-2026-95848 · published 21 days ago
Summary

The Moquette MQTT broker could start without enforcing login or permissions when a custom security component cannot be loaded, such as due to a typo or missing library. This means anyone could connect and publish messages even though security was intended. Upgrade to version 0.18.1 or later to ensure the broker stops if the security classes cannot be initialized.

What to do
  • Update moquette moquette to version 0.18.1 or later.
Affected software
VendorProductAffected versions
moquette-io moquette < 0.18.1
moquette moquette < 0.18.1
cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*
Original advisory text
Moquette fails open when configured authentication or authorization classes cannot load
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-636Not Failing Securely ('Failing Open')
Timeline
Published23 Sep 2026
Updated15 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-95848 · NVD
CVE-2026-95848 · MITRE
Track software like this
Free during beta