CVE-2026-121535: miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miroslavpejic85 MiroTalk P2Pto a version that resolves this vulnerability.Fixed in 2.1.38Patch 55bec1d05f931d2e43633d6d0b7274f79ec719dd
Event History
Frequently Asked Questions
Which deployments are affected?
MiroTalk P2P deployments using versions up to 2.0.87 are affected. The issue is in the Room Action Handler's checkPassword function in app/src/server.js.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. However, exploitation is described as highly complex and difficult, despite a public exploit being available.
Are confidentiality, integrity, or availability impacts expected?
The supplied severity vector indicates low confidentiality impact, with no integrity or availability impact. The issue concerns insufficient restriction of excessive authentication attempts.
What is the remediation?
Upgrade MiroTalk P2P to version 2.1.38. The identified patch is 55bec1d05f931d2e43633d6d0b7274f79ec719dd.