CVE-2017-5593: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacke...

Security readout for executives and security teams

CVE-2017-5593 is a messaging trust issue in specific Psi+ XMPP client builds. A remote attacker could make the vulnerable client display a message as if it came from another user, including a trusted contact. The main business risk is deception-driven action by users, not direct system takeover. Exposure is limited to environments where users still run the listed Psi+ builds. Risk is higher where XMPP is used for trusted operational, administrative, or customer-support communication. Prioritize remediation where XMPP messages influence payments, credentials, support actions, or operational decisions. The issue is not listed as actively exploited, but it can undermine trust in internal communications. Mitigation focus: Inventory Psi+ installations and identify versions 0.16.563.580 through 0.16.571.627.; Move users off affected Psi+ builds according to vendor or maintainer guidance.; Review the referenced upstream fix if maintaining source-built clients..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.