CVE-2020-8086: Debian Linux

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Prosody Mod Auth LDAP: up to and including 2020-01-27
• Prosody Mod Auth LDAP2: up to and including 2020-01-27

Published 2020-01-28. Last modified 2026-06-17.