Moquette, a lightweight Java MQTT broker, versions before 0.18.1 improperly handle failures when loading configured authenticator or authorizator classes. Instead of failing securely, the Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy methods treat such failures as if no custom class was configured and default to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. This results in the broker starting with authentication or authorization disabled, potentially allowing unauthorized access. The root causes include misspelled class names, missing dependencies, constructor failures, or classpath problems. The vulnerability is addressed in version 0.18.1.

If exploited, this vulnerability allows an attacker to bypass authentication and authorization controls on the MQTT broker, potentially enabling unauthorized access and control over MQTT topics and messages. The broker may start with no effective access controls despite operator configuration, leading to a critical security risk.

Upgrade moquette to version 0.18.1 or later where this issue is fixed. Prior to upgrading, verify that authenticator and authorizator classes are correctly configured and loadable to avoid fallback to permissive defaults.