CVE-2025-64754CWE-601

CVE-2025-64754

published November 14, 2025

CVSS

2.7

EPSS

Percentile

33.8

In the wild

Unconfirmed

What it is

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.

The record

Technical detail

CVSS: 2.7 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00406 · 33.8th percentile
Weakness: CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published: 2025-11-14T03:15Z

References (1)

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78 · [email protected]

EPSS history

Timeline

13 NOV 21:48Z
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
cvelistv5