CVE-2016-10027: Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has be...

Security readout for executives and security teams

This flaw can make an XMPP client believe TLS is unavailable even when TLS is required, causing authentication to proceed without encryption. A network-positioned attacker could use that to expose credentials or session data. Public sources do not show confirmed active exploitation. Exposure is most likely in Java applications or XMPP clients embedding Smack before 4.1.9, especially where SecurityMode.required was expected to guarantee encrypted authentication. Prioritize remediation where XMPP carries user credentials, internal messaging, or service authentication across untrusted networks. The issue is not KEV-listed, but credential exposure makes stale affected clients worth replacing. Mitigation focus: Upgrade Smack to 4.1.9 or later where feasible.; Apply vendor-patched packages, including distribution advisories such as Fedora where applicable.; Confirm applications do not authenticate to XMPP services over cleartext..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.