CVE-2021-39215

Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms

CVSS 7.5 HIGHEPSS 1.2%CWE-287

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 Sep 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

jitsi · jitsi-meet

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/jitsi/jitsi-meet/pull/9319 https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx