Janus Gateway EUVD-2026-97353

Requires an authenticated VideoRoom participant (PR:L) able to send 'publish' requests, and the targeted room must have a max_publishers cap whose enforcement is the thing being subverted. The attacker must win a narrow timing window (CWE-362 race between the session 'starting' and 'started' states) to register as an active publisher before the count check applies - the patch introduces a 'starting' atomic flag so the limit counts in-progress publishers too. Limiting factors: high attack complexity (AC:H, vendor-stated 'difficult'), required low-privilege authenticated access to the room, relevance only to rooms that enforce a publisher limit, and minor impact (integrity/availability Low, no confidentiality). No network-unauthenticated path exists despite AV:N.

This is a genuinely LOW-priority issue, and the signals are internally consistent on that point. The CVSS 4.0 base score is only 2.3 with vector AV:N/AC:H/AT:N/PR:L/UI:N and impact limited to VI:L/VA:L (no confidentiality). AC:H plus the description's explicit 'exploitability is difficult' / 'complexity high' language reflects a timing-dependent race condition (CWE-362) that an attacker must win a narrow window to trigger. PR:L means some authenticated foothold (a valid VideoRoom participant able to send 'publish') is required - this is NOT remote-unauthenticated despite AV:N. A public reference is tagged 'exploit' (E:P / POC=YES), but that reference actually points at the upstream source file janus_videoroom.c rather than demonstrable weaponized exploit code, so the practical value of the 'POC' is questionable. The CVE is NOT in CISA KEV and no EPSS probability was supplied, so there is no evidence of real-world or automatable exploitation. CONFLICT TO NOTE: the input Tags list 'Information Disclosure', but the CVSS vector sets VC:N (no confidentiality impact) and the patch diff concerns enforcement of the max_publishers limit, not data exposure - the Information Disclosure label appears incorrect and should not drive triage. Net: a high-CVSS narrative is absent here; this is correctly a low-real-risk, difficult-to-exploit integrity/availability nuisance.

An authenticated WebRTC participant who can send 'publish' requests to a janus-gateway VideoRoom rapidly issues concurrent publish attempts, racing the window between a session being 'starting' and fully 'started'. Because the pre-patch code only counted sessions already flagged 'started' when enforcing max_publishers, a winning race lets more publishers become active than the room's configured limit, degrading room integrity/availability. A public reference exists but is a link to upstream source rather than a turnkey exploit, and AC:H makes reliable triggering difficult.