The vulnerability CVE-2026-104733 affects ProcessOne ejabberd XMPP server versions from 0 up to but not including 26.07. It arises from improper validation of the authzid parameter in the SASL-PLAIN authentication mechanism, enabling an attacker with low privileges to impersonate arbitrary users. The CVSS 4.0 base score is 7.4, indicating a high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no patch or vendor advisory information is provided in the input data.

Successful exploitation allows an attacker with limited privileges to impersonate any user on the ejabberd server, potentially gaining unauthorized access to user accounts and sensitive communications. This can compromise confidentiality and integrity of data and disrupt service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SASL-PLAIN mechanism or implement additional authentication controls to mitigate risk.