CVE-2025-59154: 
Java vulnerability analysis and mitigation

A vulnerability in Openfire's SASL EXTERNAL mechanism for client TLS authentication (CVE-2025-59154) was discovered on September 15, 2025. The vulnerability affects Openfire versions prior to 5.0.2, allowing potential identity spoofing through unsafe parsing of X.509 certificate Common Names (CNs). This security issue impacts the XMPP server's authentication mechanism when using client certificates (GitHub Advisory).

The vulnerability stems from improper extraction of user identities from X.509 certificates. Instead of parsing structured ASN.1 data, the code uses X509Certificate.getSubjectDN().getName() with regex to find CN=, resulting in provider-dependent strings that don't escape special characters. In SunJSSE implementations, commas and equals signs inside attribute values remain unescaped, allowing attackers to embed CN= inside another attribute value (e.g., OU="CN=admin,"). The CVSS v3.1 score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N (GitHub Advisory).

When exploited, this vulnerability allows attackers to impersonate other users if SASL EXTERNAL is enabled and configured to map CNs to user accounts. The primary risks exist in private CA environments and client certificate authentication scenarios, where identity mapping may rely solely on the CN. While certificates issued by public CAs for use on the open Internet are unlikely to be exploitable, older certificates still within their validity period could potentially be abused (GitHub Advisory).

The vulnerability has been patched in Openfire versions 5.0.2 and 5.1.0. The fix replaces the use of getSubjectDN().getName() with standards-compliant LdapName parsing of the RFC2253 representation of X500Principal. For users unable to upgrade immediately, workarounds include using SAN-only mapping by configuring the mapper list to only include org.jivesoftware.util.cert.SANCertificateIdentityMapping, or disabling certificate-based authentication entirely. Starting with version 5.0.2, Openfire defaults to preferring Subject Alternative Name-based identity over Common Name for client-to-server authentication (GitHub Advisory).