CVE-2026-95848

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1

Description When a configured authenticator or authorizator class cannot be loaded, the Server.initializeAuthenticator() and Server.initializeAuthorizatorPolicy() functions treat the failure as if no custom class was configured. This causes the system to fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. Consequently, issues such as misspelled class names, missing dependencies, constructor failures, or classpath problems can result in the broker starting with authentication or authorization disabled, despite the operator's configuration.

Recommendations Update to version 0.18.1.