Threat database

Janus WebRTC Server versions up to 1.4.3 have a path traversal vulnerability in the Record&Play plugin. This flaw allows unauthenticated attackers to write files outside the intended recordings directory by manipulating the filename parameter in record requests. The vulnerability permits creation or truncation of files ending with -audio.mjr, -video.mjr, or -data.mjr anywhere writable by the Janus process.

CVE-2026-108831 is a medium severity vulnerability in meetecho janus-gateway versions 1.4.0, 1.4.1, and 1.4.2. It involves hard-coded credentials in the Admin API component, specifically in the html/demos/admin.js file. This flaw allows remote attackers to exploit these credentials. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. Public exploit details have been disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation information is provided.

CVE-2026-108830 is a race condition vulnerability in meetecho janus-gateway versions 1.4.0, 1.4.1, and 1.4.2 affecting the VideoRoom component. The flaw allows remote exploitation but requires high attack complexity and limited privileges. The vendor has released a patch to fix this issue.