An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display.
CVSS 3.1MEDIUM 5.9·Network·No auth·No interaction·EPSS 0.01714·Published 2017-02-09·Fixed in 1.2.4, 1.3.2CWE-20