CVE-2026-108831: Hard-coded Credentials in meetecho janus-gateway

The vulnerability CVE-2026-108831 affects meetecho janus-gateway up to version 1.4.2. It is caused by hard-coded credentials present in the Admin API code within the file html/demos/admin.js. This allows remote attackers to potentially gain unauthorized access by leveraging these static credentials. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, but no active exploitation has been reported.

The presence of hard-coded credentials in the Admin API can allow remote attackers to authenticate without proper authorization, potentially leading to unauthorized access or control over the affected janus-gateway instance. The impact is limited by the scope of the Admin API and the level of privileges granted by the hard-coded credentials. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Admin API and avoid exposing the vulnerable versions to untrusted networks. Monitor vendor channels for updates and apply patches promptly once released.