High · published December 25, 2025
⚡ A sneaky missing authentication flaw lets an attacker with access to one node mess with all others in a Pexip Infinity installation! 🔥 Imagine a hotel where one rogue guest can change the room keys for everyone else, letting them stroll right into any room they please – that’s the kind of chaos this vulnerability could unleash! An attacker could take advantage of this flaw to not only disrupt video communications by affecting the operation of other nodes but also potentially execute malicious commands across the Pexip Infinity network. This could lead to unauthorized access, data breaches, or even complete shutdown of services, threatening the integrity of critical communications.
Imagine a hotel where one rogue guest can change the room keys for everyone else, letting them stroll right into any room they please – that’s the kind of chaos this vulnerability could unleash! CVE-2025-66377 highlights a missing authentication vulnerability in Pexip Infinity's internal API, which allows an attacker with limited access on one node to manipulate and impact the functioning of other nodes in the system.
An attacker could take advantage of this flaw to not only disrupt video communications by affecting the operation of other nodes but also potentially execute malicious commands across the Pexip Infinity network. This could lead to unauthorized access, data breaches, or even complete shutdown of services, threatening the integrity of critical communications. To mitigate this risk, upgrade to Pexip Infinity version 39.0 or higher immediately. Ensure strict authentication measures are implemented on all product-internal APIs to prevent unauthorized access. Regular audits and security testing should also be conducted to identify potential weaknesses. 🛡️ You’ve got this! With these steps, you’ll fortify your defenses and keep your communications secure! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| pexip/pexip_infinity | < 39.0 | 39.0 |