Igniterealtime

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Igniterealtime product.

RSS Feeds for Igniterealtime security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Igniterealtime products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Igniterealtime Sorted by Most Security Vulnerabilities since 2018

Igniterealtime Openfire24 vulnerabilities

Igniterealtime Smack3 vulnerabilities

Igniterealtime User Import Export1 vulnerability

By the Year

In 2026 there have been 1 vulnerability in Igniterealtime with an average score of 6.4 out of ten. Last year, in 2025 Igniterealtime had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Igniterealtime in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.50.

Year	Vulnerabilities	Average Score
2026	1	6.40
2025	1	5.90
2024	2	7.20
2023	1	8.60
2022	1	9.80
2021	0	0.00
2020	13	5.54
2019	3	6.10
2018	2	7.10

It may take a day or so for new Igniterealtime vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Igniterealtime Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2020-36956	Jan 26, 2026	Openfire 4.6.0 NodeJS Plugin XSS via 'path' param Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page.	Openfire
CVE-2025-59154	Sep 15, 2025	Openfire <5.0.2 SASL EXTERNAL CN Regex & Impersonation Openfire is an XMPP server licensed under the Open Source Apache License. Openfires SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls X509Certificate.getSubjectDN().getName() and applies a regex to look for CN=. This method produces a provider-dependent string that does not escape special characters. In SunJSSE (sun.security.x509.X500Name), for example, commas and equals signs inside attribute values are not escaped. As a result, a malicious certificate can embed CN= inside another attribute value (e.g. OU="CN=admin,"). The regex will incorrectly interpret this as a legitimate Common Name and extract admin. If SASL EXTERNAL is enabled and configured to map CNs to user accounts, this allows the attacker to impersonate another user. The fix is included in Openfire 5.0.2 and 5.1.0.	Openfire
CVE-2024-25420	Mar 26, 2024	Openfire 4.9.0 Privilege Escalation via admin.authorizedJIDs property An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.	Openfire
CVE-2024-25421	Mar 26, 2024	Openfire <=4.9.0 Priv Esc via ROOM_CACHE An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.	Openfire
CVE-2023-32315	May 26, 2023	Openfire XMPP Server Path Traversal in Admin Console (3.10.0+) Fix 4.7.5/4.6.8 Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isnt available for a specific release, or isnt quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.	Openfire
CVE-2021-45967	Mar 18, 2022	An issue was discovered in Pascom Cloud Phone System before 7.20.x An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.	Openfire
CVE-2020-35202	Dec 12, 2020	Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.	Openfire
CVE-2020-35199	Dec 12, 2020	Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS. Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.	Openfire
CVE-2020-35200	Dec 12, 2020	Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.	Openfire
CVE-2020-35201	Dec 12, 2020	Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS. Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.	Openfire