org.jivesoftware.openfire.entitycaps.EntityCapabilitiesManager#generateVerHash generates a hash value, based on some input and the name of a hash algorithm. The name is completely ignored, and SHA-1 is used. All known use-cases do use this algorithm, which is why there likely aren’t any issues with this, but still: Openfire should either use the provided algorithm name, or not allow for a name to be provided.