---
id: "CVE-2026-121539"
kind: "vulnerability"
aliases: ["CVE-2026-121539"]
title: "MiroTalk P2P: Socket.IO password check flaw allows improper access remotely"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mirotalk-p2p", "node.js", "package", "self-hosted", "socket.io"]
not_affected_if: ["version-2.1.39-or-later"]
published_at: "2026-11-03T23:17:34+00:00"
first_seen_at: "2026-11-03T23:45:14+00:00"
updated_at: "2026-11-03T23:45:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121539", "first_seen_at": "2026-11-03T23:45:14+00:00"}]
---

# MiroTalk P2P: Socket.IO password check flaw allows improper access remotely

MiroTalk P2P, a browser video-call app, has a flaw in its Socket.IO handler where the CheckPassword function in app/src/server.js mishandles the peer_id argument, so access controls can be bypassed. A remote attacker can trigger it over the network without special setup according to the description.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MiroTalk P2P version and whether it is `2.0.87` or earlier, or `2.1.38` or earlier.
- Look at `app/src/server.js` for the `CheckPassword` function and how it handles `peer_id`.

## Fix

- Upgrade MiroTalk P2P to `2.1.39`.

## Timeline

- 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121539

## Documents

- [fix] Patch: github.com https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471

## From the sources

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_