TrueConf Server CVE-2025-66824

The attacker must hold an authenticated TrueConf Server account with at least the privilege level required to create or edit conferences (PR:L per CVSS vector). No elevated administrative role is required to inject the payload. A victim user with an active authenticated session must subsequently visit the Conference Info page of the poisoned conference (UI:R per CVSS vector) - because the payload is stored server-side, this trigger is passive and persistent rather than requiring real-time attacker interaction. Exploitation is bounded to TrueConf Server version 5.5.2.10813 on Windows per available CPE data; other versions or non-Windows platforms are not confirmed vulnerable. No special network position or man-in-the-middle capability is required beyond authenticated HTTP/HTTPS access to the TrueConf Server instance.

The CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) accurately reflects the severity: the attack is network-accessible, requires low complexity, and demands only a low-privilege account - a low bar in a conferencing platform where many users can create meetings. The Scope:Changed flag elevates the score because the injected payload executes in victim browsers rather than the attacker's own context. The publicly available PoC on GitHub materially lowers the skill threshold for exploitation. No EPSS data was provided in the input, and the CVE is not in CISA KEV, so confirmed widespread active exploitation is not established at this time - however, the combination of stored XSS, ATO impact, low complexity, and public PoC makes this a genuine operational priority for any organization running this platform. No patch version was identified in the available references, which increases urgency for compensating controls.

An attacker with a low-privilege TrueConf account - such as a regular employee in a corporate deployment - navigates to the conference creation interface and injects a JavaScript payload (e.g., a cookie-stealing script) into the Meeting Location field. The payload is stored on the server. When a higher-privileged user, such as an administrator, opens the Conference Info page for that meeting, the script executes silently in their browser, exfiltrating their session token to the attacker and granting full account takeover. A public PoC demonstrating this technique is available at https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-66824/README.md.