CVE-2009-1595

The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.

• CWE-287

• http://osvdb.org/54189
• http://secunia.com/advisories/34976Vendor Advisory
• http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.htmlPatch
• http://www.igniterealtime.org/community/message/190280Exploit, Patch, Vendor Advisory
• http://www.igniterealtime.org/issues/browse/JM-1531Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34804Exploit, Patch
• http://www.vupen.com/english/advisories/2009/1237Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50292
• http://osvdb.org/54189
• http://secunia.com/advisories/34976Vendor Advisory
• http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.htmlPatch
• http://www.igniterealtime.org/community/message/190280Exploit, Patch, Vendor Advisory
• http://www.igniterealtime.org/issues/browse/JM-1531Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34804Exploit, Patch
• http://www.vupen.com/english/advisories/2009/1237Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50292

Published

May 11, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1589Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.0…
• CVE-2009-1590Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.4…
• CVE-2009-1591CRLF injection vulnerability in CGI RESCUE Web Mailer before…
• CVE-2009-1592Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.2…
• CVE-2009-1593Armorlogic Profense Web Application Firewall before 2.2.22, …
• CVE-2009-1594Armorlogic Profense Web Application Firewall before 2.2.22, …
• CVE-2009-1596Ignite Realtime Openfire before 3.6.5 does not properly impl…6.5
• CVE-2009-1597Mozilla Firefox executes DOM calls in response to a javascri…
• CVE-2009-1598Google Chrome executes DOM calls in response to a javascript…
• CVE-2009-1599Opera executes DOM calls in response to a javascript: URI in…
• CVE-2009-1600Apple Safari executes DOM calls in response to a javascript:…
• CVE-2009-1601The Ubuntu clamav-milter.init script in clamav-milter before…