CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing
Attackers can impersonate users by crafting certificates with spoofed Common Names if SASL EXTERNAL is enabled, requiring an upgrade to Openfire.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59154?
CVE-2025-59154 is a medium-severity authentication bypass vulnerability in igniterealtime Openfire, published on 15 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls X509Certificate.getSubjectDN().getName() and applies a regex to look for CN=. This method produces a provider-dependent string that does not escape special characters. In SunJSSE (sun.security.x509.X500Name), for example, commas and equals signs inside attribute values are not escaped. As a result, a malicious certificate can embed CN= inside another attribute value (e.g. OU="CN=admin,"). The regex will incorrectly interpret this as a legitimate Common Name and extract admin. If SASL EXTERNAL is enabled and configured to map CNs to user accounts, this allows the attacker to impersonate another user. The fix is included in Openfire 5.0.2 and 5.1.0.
Weakness: CWE-290
Which versions are affected by CVE-2025-59154?
2 open source packages ship an affected version, including org.igniterealtime.openfire:xmppserver.
| Package | Affected | Fixed in |
|---|---|---|
org.igniterealtime.openfire:xmppserver Maven | All versions | 5.0.2 |
org.igniterealtime.openfire:xmppserver Maven | All versions | 5.0.2 |
How do I fix CVE-2025-59154?
Upgrade org.igniterealtime.openfire:xmppserver to 5.0.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-59154 being exploited?
There is no known exploitation of CVE-2025-59154 in the wild and no public exploit code.
Sources
Also known as GHSA-w252-645g-87mp.