Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-95848Moquette fails open when configured authentication or authorization classes cannot load

Critical 9.3

In plain English

A critical-severity security flaw in moquette from moquette-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 63.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.moquette:moquette-broker	0.18.1	GHSA-5f42-97gr-vfhq

Affected products (as reported)

Vendor	Product	Versions
moquette-io	moquette	< 0.18.1

Weakness: CWE-636 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/967 x_refsource_MISC
https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007 x_refsource_MISC
https://github.com/moquette-io/moquette/releases/tag/v0.18.1 x_refsource_MISC