{"id":"CVE-2026-121539","kind":"vulnerability","aliases":["CVE-2026-121539"],"related":[],"title":"MiroTalk P2P: Socket.IO password check flaw allows improper access remotely","description":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.","summary":"MiroTalk P2P, a browser video-call app, has a flaw in its Socket.IO handler where the CheckPassword function in app/src/server.js mishandles the peer_id argument, so access controls can be bypassed. A remote attacker can trigger it over the network without special setup according to the description.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mirotalk-p2p","node.js","package","self-hosted","socket.io"],"not_affected_if":["version-2.1.39-or-later"],"how_to_check":"- Check the installed MiroTalk P2P version and whether it is `2.0.87` or earlier, or `2.1.38` or earlier.\n- Look at `app/src/server.js` for the `CheckPassword` function and how it handles `peer_id`.","fix":"- Upgrade MiroTalk P2P to `2.1.39`.","status":"open","published_at":"2026-11-03T23:17:34+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:40+00:00","updated_at":"2026-11-03T23:45:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T23:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MiroTalk P2P to `2.1.39`.","reach":"internet","title":"MiroTalk P2P: Socket.IO password check flaw allows improper access remotely","impact":"medium","summary":"MiroTalk P2P, a browser video-call app, has a flaw in its Socket.IO handler where the CheckPassword function in app/src/server.js mishandles the peer_id argument, so access controls can be bypassed. A remote attacker can trigger it over the network without special setup according to the description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mirotalk-p2p","self-hosted","node.js","socket.io"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unauthorized peer access to sessions through the socket handler","analyst_note":"","how_to_check":"- Check the installed MiroTalk P2P version and whether it is `2.0.87` or earlier, or `2.1.38` or earlier.\n- Look at `app/src/server.js` for the `CheckPassword` function and how it handles `peer_id`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.1.39-or-later"],"who_is_affected":"Teams that self-host MiroTalk P2P up to version 2.0.87 or 2.1.38 are exposed through its Socket.IO server. The description does not say which deployment configurations are required, so instances reachable from the internet are the priority to review.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4224,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121539':13A,16A '-2026':12A,15A '/2.1.38':85C '2.0.87':84C '2.1.39':128C '4e40471':137C 'abc48bfc32b4b174b8844716dfc5c1471':138C 'access':9A,53B,115C 'accord':70B 'affect':86C,143C 'allow':7A 'app':33B 'app/src/server.js':46B,97C 'argument':51B,109C 'attack':60B,123C 'browser':29B 'bypass':57B 'call':32B 'check':5A 'checkpassword':43B,93C 'compon':100C,144C 'control':54B,116C 'cve':11A,14A 'descript':73B 'file':96C 'flaw':6A,36B 'found':77C 'function':44B,92C 'handler':40B,103C 'host':24B 'id':50B,111C 'improp':8A,114C 'initi':121C 'io':102C 'issu':89C,132C 'manipul':106C 'miroslavpejic85':79C 'mirotalk':1A,18B,26B,80C 'mirotalk-p2p':17B 'mishandl':47B 'name':136C 'network':66B 'node.js':20B 'p2p':2A,19B,27B,81C 'packag':21B 'password':4A 'patch':134C 'peer':49B,110C 'perform':104C 'possibl':119C 'remot':10A,59B,124C 'resolv':130C 'result':112C 'self':23B 'self-host':22B 'setup':69B 'socket':101C 'socket.io':3A,25B,39B 'special':68B 'trigger':62B 'upgrad':125C,141C 'version':127C 'video':31B 'video-cal':30B 'vulner':75C 'without':67B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host MiroTalk P2P up to version 2.0.87 or 2.1.38 are exposed through its Socket.IO server. The description does not say which deployment configurations are required, so instances reachable from the internet are the priority to review.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mirotalkp2p","nodejs","package","selfhosted","socketio"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121539","severity":null,"published_at":"2026-11-03T23:17:34+00:00","modified_at":"2026-11-03T23:17:34+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null}],"documents":[{"id":61623,"url":"https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}