CVE-2018-10847

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

• CWE-592
• CWE-287

• https://blog.prosody.im/prosody-0-10-2-security-release/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10847Issue Tracking, Third Party Advisory
• https://issues.prosody.im/1147Vendor Advisory
• https://prosody.im/security/advisory_20180531/Vendor Advisory
• https://www.debian.org/security/2018/dsa-4216Third Party Advisory
• https://blog.prosody.im/prosody-0-10-2-security-release/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10847Issue Tracking, Third Party Advisory
• https://issues.prosody.im/1147Vendor Advisory
• https://prosody.im/security/advisory_20180531/Vendor Advisory
• https://www.debian.org/security/2018/dsa-4216Third Party Advisory

Published

Jul 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10841glusterfs is vulnerable to privilege escalation on gluster s…8.8
• CVE-2018-10842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-10843source-to-image component of Openshift Container Platform be…8.5
• CVE-2018-10844It was found that the GnuTLS implementation of HMAC-SHA-256 …5.9
• CVE-2018-10845It was found that the GnuTLS implementation of HMAC-SHA-384 …5.9
• CVE-2018-10846A cache-based side channel in GnuTLS implementation that lea…5.6
• CVE-2018-10848Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10849Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1085openshift-ansible before versions 3.9.23, 3.7.46 deploys a m…9
• CVE-2018-10850389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable …5.9
• CVE-2018-10851PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.…5.3
• CVE-2018-10852The UNIX pipe which sudo uses to contact SSSD and read the a…3.8