Jitsi Meet
Approved changes feed: RSS · Atom
cpe:2.3:a:jitsi:jitsi-meet:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jitsi (cfece043-1904-5c0e-99a8-c014e18f945e) |
|---|---|
| Product | Jitsi Meet (c51771dc-d98e-555f-afd4-50f5002e4f7d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-64754 |
vulnerable | 2026-06-08 07:39:20.250711 |
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
Published: 2025-11-13T21:48:08.692Z
Updated: 2025-11-14T16:03:57.905Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39215 |
vulnerable | 2026-06-08 05:33:49.207270 |
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
HIGH (7.5)
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
Published: 2021-09-15T17:20:11.000Z
Updated: 2024-08-04T01:58:18.219Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39205 |
vulnerable | 2026-06-08 05:33:49.195119 |
DOM-based XSS/Content Spoofing via Prototype Pollution
MEDIUM (6.8)
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
Published: 2021-09-15T17:15:12.000Z
Updated: 2024-08-04T01:58:18.260Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.