MiroTalk P2P CVE-2026-121539

Requires the attacker to already hold an active Socket.IO connection to the MiroTalk P2P signaling server (PR:L - a joined/connected peer, not fully unauthenticated), and to supply a target peer's socket id (peer_id) to the 1:1 relay handlers (relayICE/relaySDP and related presenter/room handlers). The pre-patch code lacked a check that caller and target share a room, so a connected socket could reach peers of other rooms by guessing or learning their socket id. Limiting factors: the actor must have a live socket on the server, must know or guess a valid target socket id, and impact is confined to WebRTC signaling relay (ICE/SDP) rather than direct server or data-store compromise; no user interaction is required. Updating to 2.1.39 is the vendor-stated remediation.

This is a medium-severity access-control flaw (CWE-284), not a high-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 and, with PR:L, requires an authenticated/connected actor - so this is network-reachable but not fully unauthenticated. No EPSS score is provided and there is no CISA KEV listing, so there is no public evidence of active exploitation; the only exploitation signal is a third-party GitHub 'vulnerability-reports' reference, which is a PoC reference rather than verified working exploit code. The vuln.today decision label is 'this_month', consistent with a real-but-moderate issue that should be remediated on a normal patch cadence rather than an act_now/emergency fix. Note a data discrepancy: the NVD/VulDB description attributes the flaw to a 'CheckPassword' function and 'peer_id' manipulation, but the vendor patch commit (4e40471) actually adds room-membership authorization (isPeerInSameRoom/isPeerInRoom) to the relayICE, relaySDP and related Socket.IO relay handlers - verify the exact mechanism with the vendor, as the description and source evidence do not fully align. Overall: a legitimate authorization weakness with low per-signal impact and no confirmed exploitation, warranting timely but not emergency patching.

An actor with an active Socket.IO connection to a MiroTalk P2P signaling server supplies another participant's socket id as peer_id to a relay handler, causing ICE/SDP signaling to be relayed to or from peers in rooms the actor never joined. This enables cross-room signaling exposure or injection by guessing or learning a target socket id. A public PoC reference exists (third-party GitHub report); it is not verified as working exploit code.