Janus Gateway EUVD-2026-97356

Exploitation requires that the target deployment actually serves the bundled demo HTML/JavaScript (html/demos/admin.js) and exposes the Admin API reachable by the attacker - this is a demo/sample asset, not a core runtime path, so production deployments that do not ship the demo pages or that restrict Admin API access are not exposed. Per the CVSS 4.0 vector the issue is network-reachable (AV:N) with low complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N). Limiting factors: impact is bounded to Low confidentiality/integrity/availability with no subsequent-system scope change, affected versions are janus-gateway ≤ 1.4.2, and risk is confined to installations that have not removed or firewalled the demo content. Upgrading past 1.4.2 and not exposing demo pages removes the exposure.

This is a low-priority, low-real-risk issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L) yields only a 2.1 score, with Low impact across confidentiality, integrity, and availability, and no subsequent-system impact (SC/SI/SA:N). The flaw is CWE-798 hard-coded credentials located in a client-side demo file (html/demos/admin.js) shipped with the Admin API component, not in the core gateway runtime - meaning the real exposure is limited to deployments that expose the bundled demo pages. The CVSS vector carries E:P (proof-of-concept) and the description states the exploit was publicly disclosed, so publicly available exploit code exists; however, there is NO CISA KEV listing and no EPSS value was provided in the input, so there is no evidence of widespread or active exploitation - this appears to be a disclosed-but-not-weaponized finding. A notable conflict: the single tag 'Authentication Bypass' overstates the issue, since CWE-798 (hard-coded credentials) is the documented weakness and the impacts are all rated Low, not a full authentication bypass granting elevated control. The sole source is VulDB with no vendor advisory, so affected-version and fix data are unverified.

An attacker who can reach a Janus Gateway instance that serves the bundled HTML demo pages reads html/demos/admin.js, extracts the hard-coded credentials/secret embedded for the Admin API, and reuses them to authenticate to the Admin API. Public proof-of-concept disclosure means the credential location is already known; because the attack vector is network-based with low complexity, no local access or special tooling is required, though real impact is limited to the Low-rated confidentiality, integrity, and availability effects described.