Description
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libqxmpp | 1.16.1-1.1 | openSUSE-SU-2026:11142-1 |
Advisories 1
- openSUSE-SU-2026:11142-1 libQXmppQt6-10-1.16.1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026