CVE-2026-108831

MediumCVSS 6.3

Published: 12/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability was detected in meetecho janus-gateway up to 1.4.2, affecting unknown code in html/demos/admin.js of the Admin API component. The manipulation leads to hard-coded credentials. The attack can be executed remotely, and the exploit has been publicly disclosed.

Risk Assessment

The organization is exposed to unauthorized access to the admin panel, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to immediately update janus-gateway to the latest version and change all default credentials.

Other vulnerabilities in janus-gateway

CVE-2026-108830Medium
A weakness was identified in meetecho janus-gateway up to 1.4.2, affecting src/plugins/janus_videoroom.c of the VideoRoom component, causing a race condition. Remote exploitation is possible but has high complexity and is difficult. A patch named 27c0d1af888153e818675b56a4e6267f62d57097 is available.

Original NVD description (English source)

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS