Live › vulnerability › CVE-2026-121539
MiroTalk P2P, a browser video-call app, has a flaw in its Socket.IO handler where the CheckPassword function in app/src/server.js mishandles the peer_id argument, so access controls can be bypassed. A remote attacker can trigger it over the network without special setup according to the description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams that self-host MiroTalk P2P up to version 2.0.87 or 2.1.38 are exposed through its Socket.IO server. The description does not say which deployment configurations are required, so instances reachable from the internet are the priority to review.
No product ranges from the sources yet.
2.0.87 or earlier, or 2.1.38 or earlier.app/src/server.js for the CheckPassword function and how it handles peer_id.2.1.39.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-121539")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.