CVE-2026-43504: 
NixOS vulnerability analysis and mitigation

CVE-2026-43504 is an incorrect authorization vulnerability in Prosody's mod_proxy65 module that allows unauthenticated network attackers to relay traffic through the SOCKS5 proxy without proper credential verification. It affects Prosody versions before 0.12.6 and versions 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. The vulnerability was disclosed on May 1, 2026, with fixes available in Prosody 0.12.6 and 13.0.5. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Openwall).

The root cause is classified as CWE-863 (Incorrect Authorization) and stems from two distinct bugs in mod_proxy65. First, due to changes in Prosody's default network backend, a connection that mod_proxy65 considered "paused" could actually transmit data through the proxy before authorization was completed. Second, mod_proxy65 only enforced access control rules during the discoverability stage of the SOCKS5 protocol, not during the activation stage — meaning any entity that could guess the proxy's domain and port (default: port 5000) could bypass the discoverability stage entirely and use the proxy unauthenticated. The module is not a generic SOCKS5 proxy and does not make outbound connections, which limits the scope of abuse to scenarios where both peers connect to the proxy and complete a SOCKS5 handshake (Openwall, GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to relay unauthorized traffic through the Prosody SOCKS5 proxy, resulting in low integrity and low availability impacts. While confidentiality is not directly compromised, unauthorized file transfer relaying could facilitate data exfiltration between XMPP entities. The vulnerability requires no user interaction and has low attack complexity, but its scope is limited since mod_proxy65 cannot proxy connections to arbitrary external endpoints and requires both peers to perform a SOCKS5 handshake (Openwall, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement that mod_proxy65 be enabled (it is not enabled in the default Prosody configuration) and that an attacker know or guess the proxy's domain and port (GitHub Advisory, Openwall).

1. Reconnaissance: Identify Prosody XMPP server instances with mod_proxy65 enabled by scanning for the default SOCKS5 proxy port (TCP 5000) using tools like Nmap or Shodan.
2. Determine proxy address: Obtain or guess the proxy domain and port. In many deployments, this follows a predictable pattern (e.g., proxy.example.com:5000).
3. Skip discoverability stage: Bypass the XMPP service discovery step (which would normally enforce access control) and connect directly to the SOCKS5 proxy port without prior XMPP authentication.
4. Initiate SOCKS5 handshake: Establish a TCP connection to the proxy port and perform the SOCKS5 handshake, exploiting the missing authorization check at the activation stage.
5. Relay traffic: With a second connection (or a cooperating peer), complete the two-party SOCKS5 relay setup to transfer data through the proxy without valid credentials (Openwall).

• Network: Unexpected TCP connections to port 5000 (or configured mod_proxy65 port) from unauthenticated or unknown source IPs; SOCKS5 handshake traffic from IPs not associated with known XMPP clients.
• Logs: Prosody log entries showing mod_proxy65 activation events without a preceding authenticated XMPP session or service discovery request; connections to the proxy port that do not correspond to legitimate XMPP file transfer sessions.
• Process/Service: Unusual data relay activity through the Prosody process without corresponding authenticated user sessions in XMPP connection logs (Openwall).

Upgrade Prosody to version 0.12.6 (for 0.12.x deployments) or 13.0.5 (for 1.0.0–13.0.x deployments), which include fixes in commits f34ad235cf3b and 4bbb17445ed9. If immediate patching is not possible, disable mod_proxy65 in the Prosody configuration, noting this may impact XMPP file transfers. As an additional network-level control, restrict access to the proxy port (default TCP 5000) using a firewall to only authorized clients and networks (Openwall, GitHub Advisory).

The vulnerability was disclosed by the Prosody development team via the oss-security mailing list on May 1, 2026, alongside a separate denial-of-service advisory. The Prosody team credited Max Hearnden for discovering the connection-unpausing issue and a Prosody team member for identifying the missing authorization check during code review. Debian issued a security advisory (DSA-6252-1) addressing the vulnerability in its packaged version of Prosody, and Fedora also released updates. Coverage appeared on Linux security news aggregators and vulnerability tracking platforms shortly after disclosure (Openwall, GitHub Advisory).