CVE-2026-121539: miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peerid results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miroslavpejic85 MiroTalk P2Pto a version that resolves this vulnerability.Fixed in 2.1.39Patch 4e40471abc48bfc32b4b174b8844716dfc5c1471
Event History
Frequently Asked Questions
Which deployments are affected?
MiroTalk P2P deployments running versions up to 2.0.87 or 2.1.38 are affected. Upgrading to version 2.1.39 resolves the issue.
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires low privileges. No user interaction is required.
What is the exploitation method?
The issue is in the Socket IO Handler's CheckPassword function in app/src/server.js. An attacker manipulates the peer_id argument to bypass intended access controls.
What should be done if the deployment cannot be upgraded immediately?
The provided information identifies upgrading the affected component as the remediation. The available data does not specify a configuration workaround or mitigation.
Is there a patch identifier to verify against?
The patch is identified as 4e40471abc48bfc32b4b174b8844716dfc5c1471. This can be used when verifying whether the relevant fix has been applied.