Authentication Bypass

Mosquitto is vulnerable to authentication bypass due to incorrect data validation. Clients are granted access to the broker because it incorrectly validated empty lines or malformed data in the password file, treating such data as a valid username and allowing an attacker to bypass authentication. This vulnerability does not affect the users using the mosquitto_passwd utility to create and modify their password files.