ProcessOne ejabberd SASL-PLAIN Flaw Allows Arbitrary User Impersonation Across XMPP Networks (CVE-2026-104733)

Executive Summary: Identity Spoofing Flaw in Leading Enterprise XMPP Server

ProcessOne, the maintainers of ejabberd—the ubiquitous, high-concurrency Erlang-based XMPP communications server powering enterprise collaboration platforms, telecom messaging infrastructure, and real-time gaming services—has disclosed a security vulnerability impacting user authentication integrity. Cataloged as CVE-2026-104733 and published under GitHub advisory GHSA-339c-8fr4-g2w4, the flaw enables authenticated users to seamlessly impersonate any arbitrary user or administrator across the entire chat domain.

The vulnerability stems from improper handling of the authorization identity (authzid) token during the SASL-PLAIN authentication mechanism (RFC 4616). When an attacker presents legitimate credentials for their own account while simultaneously asserting the username of another individual as their authorization identity, ejabberd accepts the assertion without validating authorization delegation rules. This grants the attacker immediate access to the victim's active presence, private chat history, and group permissions.

Protocol Dissection: SASL PLAIN authzid vs. authcid Confusion

Under the Simple Authentication and Security Layer (SASL) PLAIN mechanism defined in RFC 4616, the authentication payload consists of three null-separated fields transmitted encoded in Base64:

[authzid] NUL authcid NUL passwd

• authzid (Authorization Identity): The identity that the client wishes to act as (impersonate/delegate).
• authcid (Authentication Identity): The identity whose password is being verified.
• passwd: The cleartext password for authcid.

In standard SASL configurations, if authzid is provided and differs from authcid, the server must verify whether authcid has explicit authorization privileges (such as a service account or administrative proxy) to assume authzid. In ejabberd prior to version 26.05, the Erlang backend authenticated the password against authcid, but subsequently bound the XMPP stream JID (Jabber ID) directly to authzid without evaluating delegation policies:

%% Vulnerability flow in ejabberd_auth.erl (prior to 26.05):
check_password(Authzid, Authcid, Password) ->
    case verify_credentials(Authcid, Password) of
        ok ->
            %% DEFECT: The session is bound to Authzid regardless of who Authcid is!
            {ok, Authzid}; 
        error ->
            {error, "Invalid credentials"}
    end.

An attacker with a standard corporate account (e.g., john.doe@company.com) can supply ceo@company.com in the authzid field along with John's valid password. The server successfully validates John's credentials, but assigns the resulting session JID to ceo@company.com.

Business & Security Impact of User Impersonation

Because XMPP servers act as the authoritative source of identity for real-time messaging, unauthorized identity assumption yields catastrophic organizational compromise:

Defensive Remediation Playbook

1. Upgrade to ejabberd 26.05: Deploy ejabberd 26.05 immediately. The updated release rejects any SASL-PLAIN authentication request where authzid differs from authcid unless explicit proxy delegation rules are configured in ejabberd.yml.
2. Disable SASL-PLAIN Over Insecure Channels: Ensure that plain authentication is never permitted over unencrypted TCP connections. Enforce mandatory TLS prior to SASL negotiation:

   # In ejabberd.yml:
   listen:
     - port: 5222
       module: ejabberd_c2s
       starttls_required: true
       auth_mechanisms:
         - "SCRAM-SHA-256"
         - "PLAIN"

3. Transition to SCRAM Authentication: Migrate client authentication configurations to SCRAM-SHA-256 (Salted Challenge Response Authentication Mechanism), which inherently binds authentication and authorization tokens and eliminates password exposure.