Mirotalk P2P
Monthly
Improper access control in the Socket.IO signaling handlers of MiroTalk P2P through version 2.1.38 (and the 2.0.87 line) allows a peer that already holds a live socket connection to the server to reach other peers' WebRTC signaling channels by supplying a target's peer_id, bypassing room isolation. The impact is limited to signaling relay manipulation (ICE/SDP and related room/presenter events) with low confidentiality, integrity and availability effects - assessed as a medium-severity flaw (CVSS 3.1 5.3, PR:L), not an emergency. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has released version 2.1.39 to fix it.
Password guessing against locked MiroTalk P2P meeting rooms is effectively unlimited in versions up to 2.0.87, because the pre-join 'checkPassword' Socket.IO handler in app/src/server.js compares the supplied password with a plain string equality check and keeps no attempt counter or lockout, letting unauthenticated remote attackers fire guesses at will and use the 'OK'/'KO' reply as an oracle. Exposure is narrow: the target room must actually be password-locked and its room ID known or discoverable, and success still depends on the room password being weak or guessable, which is why this is rated medium severity rather than urgent. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation (CISA KEV), and the vendor has released a fix in 2.1.38.
A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper access control in the Socket.IO signaling handlers of MiroTalk P2P through version 2.1.38 (and the 2.0.87 line) allows a peer that already holds a live socket connection to the server to reach other peers' WebRTC signaling channels by supplying a target's peer_id, bypassing room isolation. The impact is limited to signaling relay manipulation (ICE/SDP and related room/presenter events) with low confidentiality, integrity and availability effects - assessed as a medium-severity flaw (CVSS 3.1 5.3, PR:L), not an emergency. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has released version 2.1.39 to fix it.
Password guessing against locked MiroTalk P2P meeting rooms is effectively unlimited in versions up to 2.0.87, because the pre-join 'checkPassword' Socket.IO handler in app/src/server.js compares the supplied password with a plain string equality check and keeps no attempt counter or lockout, letting unauthenticated remote attackers fire guesses at will and use the 'OK'/'KO' reply as an oracle. Exposure is narrow: the target room must actually be password-locked and its room ID known or discoverable, and success still depends on the room password being weak or guessable, which is why this is rated medium severity rather than urgent. A public PoC reference exists but is not verified as working exploit code, there is no confirmed active exploitation (CISA KEV), and the vendor has released a fix in 2.1.38.
A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.