An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. (CVE-2026-43505)

CVE-2026-43505 affects Prosody versions prior to 0.12.6 and versions 1.0.0 through 13.0.0 before 13.0.5 when the mod_proxy65 module is enabled. The vulnerability arises because mod_proxy65 mishandles access control in the activation scenario, enabling the relaying of unauthenticated traffic. This could potentially allow attackers to relay traffic without proper authentication, impacting the integrity and availability of the service. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability allows unauthenticated attackers to relay traffic through the mod_proxy65 module due to improper access control. This can lead to integrity and availability impacts on the affected Prosody service. There is no confidentiality impact reported. No known exploits in the wild have been identified at this time.

The vulnerability affects Prosody versions before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. Users should upgrade to version 0.12.6 or 13.0.5 or later where the issue is fixed. Since no vendor advisory or patch links were provided, check the official Prosody project resources for the official fixes. Until patched, disabling mod_proxy65 can mitigate the risk by removing the vulnerable component.