What’s Vulnerable › Vulnerabilities

CVE-2021-39215: Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-15 · updated 2026-06-17
• Weakness: CWE-287

Description

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.

Affected products

• jitsi-meet: 2.0.5963

References

• https://github.com/jitsi/jitsi-meet/pull/9319
• https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx
• https://github.com/jitsi/jitsi-meet/pull/9319
• https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx

Get alerted when CVE-2021-39215 or the next vulnerability affects your stack