What is the CVSS score of CVE-2025-66824?

CVE-2025-66824 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of TrueConf Server are affected by CVE-2025-66824?

TrueConf Server 5.5.2.10813 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious code into conference workflows, resulting in full account takeover…

Is there a public PoC exploit available for CVE-2025-66824?

Yes, a public proof-of-concept exploit is available for CVE-2025-66824. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-66824?

Within 24 hours, restrict conference creation and editing capabilities to administrator accounts only and inventory all TrueConf Server 5.5.2.x instances in production. Within 7 days, enable Content Security Policy (CSP) headers where available, configure granular role-based access controls limiting conference management features, and enable comprehensive audit logging for all conference operations and authentication events. Within 30 days, contact TrueConf vendor for patch timeline, evaluate upgrade paths to versions beyond 5.5.2.10813, and prepare business justification for deployment of patched releases once available.

TrueConf Server CVE-2025-66824

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 cve@mitre.org

XSS Trueconf Trueconf Server

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

PR:L reflects required authenticated conference-creator access; S:C captures cross-user browser context compromise enabling ATO; A:N because XSS imposes no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 18:33 vuln.today

CVE Published

Dec 30, 2025 - 19:15 nvd

HIGH 8.7

DescriptionNVD

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10813. The injected payload is stored via the meeting_room parameter and executed when users visit the Conference Info page, allowing attackers to achieve full Account Takeover (ATO). This issue is caused by improper sanitization of user-supplied input in the meeting_room field.

AnalysisAI

Stored XSS in TrueConf Server 5.5.2.10813 on Windows enables authenticated low-privileged users to inject malicious JavaScript via the meeting_room parameter in the conference creation/editing interface. The payload persists server-side and executes in any victim's browser upon visiting the Conference Info page, enabling full Account Takeover (ATO). A publicly available proof-of-concept exploit exists; the CVE is not listed in CISA KEV at time of analysis.

Technical ContextAI

TrueConf Server is a Windows-based video conferencing platform (CPE: cpe:2.3:a:trueconf:trueconf_server:5.5.2.10813:*:*:*:*:windows:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the persistent/stored variant. The meeting_room parameter in the Create/Edit Conference workflow accepts user-supplied input that is stored without adequate sanitization or output encoding. When TrueConf Server subsequently renders the Conference Info page, it reflects the raw stored value into the HTML DOM, allowing arbitrary JavaScript execution in any authenticated user's browser context. The CVSS Scope:Changed (S:C) metric correctly captures the cross-user nature of the impact: the attacker's injected code runs in a different security principal's browser session.

RemediationAI

No vendor-released patch or patched version was identified in the available data - references include only the PoC repository and the vendor homepage at https://trueconf.com, with no dedicated security advisory. Organizations should actively monitor https://trueconf.com for a security bulletin and apply any released update immediately upon availability. As a compensating control, restrict the conference creation and editing functionality to a minimal set of trusted users via role-based access controls, reducing the population of principals who can inject a stored payload - note this does not eliminate risk if any authorized user is compromised. Deploying a WAF with strict XSS filtering on TrueConf Server endpoints can block common injection patterns, though WAF bypasses exist and this control should not be treated as a permanent remediation. The definitive fix requires server-side input validation and context-aware output encoding on the meeting_room field at the application layer.