CVE-2021-39215CWE-287

Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms

High · published September 15, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
68.8
In the wild
Unconfirmed
What it is

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01235 · 68.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2021-09-15T17:20Z
EPSS history
Timeline
  • 15 SEP 17:20Z
    Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
    cvelistv5