CVE-2026-95848
Moquette fails open when configured authentication or authorization classes cannot load
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.
| CWE | CWE-636 |
| Vendor | moquette-io |
| Product | moquette |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for moquette-io moquette
Be the first to know when new unknown vulnerabilities affecting moquette-io moquette are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
moquette-io / moquette
< 0.18.1
References
github.com: https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq github.com: https://github.com/moquette-io/moquette/pull/967 github.com: https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007 github.com: https://github.com/moquette-io/moquette/releases/tag/v0.18.1