CVE-2026-108831: meetecho janus-gateway Admin API admin.js hard-coded credentials
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for review?
Review meetecho janus-gateway installations running version 1.4.2 or earlier, particularly where the Admin API is exposed to remote access. The affected file is html/demos/admin.js.
What level of access does an attacker need?
The CVSS vector indicates that low privileges are required. Exploitation is network-accessible and does not require user interaction.
Is public exploitation information available?
Yes. The vulnerability is marked as having a publicly disclosed exploit, so organizations should treat exposed affected deployments as higher priority.
What is the expected security impact?
The supplied CVSS assessment rates confidentiality, integrity, and availability impact as low. The overall severity is medium, with a base score of 6.3.