# CVE-2018-3778: aedes improper authorization in last will messages

Source: https://junglewise.ai/threats/cve-2018-3778-aedes-improper-authorization-in-last-will-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-08-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-3778 · Severity: low · CVSS 3.1 · Published 2018-08-15

aedes is an open-source MQTT broker used in IoT and messaging applications to route messages between connected devices. A flaw in versions before 0.35.1 causes the broker to ignore its own authorization policies when processing Last Will messages—a feature that auto-publishes a message if a client disconnects unexpectedly. An attacker can exploit this to bypass restrictions and send messages to topics they should not have access to, potentially exposing sensitive data or disrupting message integrity in connected systems.

Technologies: [aedes (npm)](https://junglewise.ai/threats/technologies/aedes). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-3778 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3778 being exploited in the wild.

**How severe is CVE-2018-3778?** Low severity, with a CVSS score of 3.1, published 15 August 2018.

**Which products and versions are affected?** aedes (npm) SEMVER:introduced=0,fixed=0.35.1.

**Is there a fix for CVE-2018-3778?** Yes. aedes (npm): upgrade to 0.35.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-3778 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-3778?** Check whether you run aedes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aedes (npm): upgrade to 0.35.1 or later

  ```sh
  npm install aedes@0.35.1
  ```


## Technical details

The vulnerability is an improper authorization (CWE-285, CWE-863) in aedes's Last Will and Testament (LWT) handling. aedes allows administrators to define an authorizePublish callback to restrict which clients can publish to which topics, but this authorization check is not applied when the broker publishes a Last Will message after a client disconnects. An unauthenticated or low-privileged attacker can connect to the broker, set a Last Will message with a payload for a restricted topic, perform an action that causes authorization failure (such as attempting an unauthorized publish), and when disconnected, the Last Will message will be published without authorization checks, reaching any subscribed clients. This bypasses the publish authorization policy entirely. The fix was released in version 0.35.1, which adds authorization checks to Last Will message publication.

## Affected products

- aedes aedes < 0.35.1

## Identifiers

- CVE-2018-3778
- GHSA-4cmx-hrq9-c23p

## Timeline

- 2018-08-06: disclosed: Security issue reported
- 2018-08-07: patched: Fix merged in version 0.35.1
- 2018-08-15: advisory: GitHub Security Advisory published

## References

- [https://github.com/moscajs/aedes/issues/211](https://github.com/moscajs/aedes/issues/211)
- [https://github.com/moscajs/aedes/issues/212](https://github.com/moscajs/aedes/issues/212)
- [https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8](https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8)
- [https://github.com/moscajs/aedes](https://github.com/moscajs/aedes)
- [https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json](https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json)

## Related threats

- [Aedes improper exception handling in packet write](https://junglewise.ai/threats/cve-2020-13410-aedes-improper-exception-handling-in-packet-write)
- [aedes incorrect authorization in Last Will processing](https://junglewise.ai/threats/aedes-incorrect-authorization-in-last-will-processing-90e624d7)