CVE-2016-0756

CVE-2016-0756 describes a vulnerability in the mod_dialback module of Prosody versions prior to 0.9.10. An attacker can exploit a flaw in the generate_dialback function, which improperly separates fields when creating dialback keys, to spoof XMPP network domains. This medium-severity vulnerability (CVSS 5.3) has a low impact on integrity and requires no user interaction, allowing remote attackers to append crafted stream IDs and domain names to target domains. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.