Skip to content
OpenAdvisories

Vendor

Jitsi

4 known vulnerabilities.

Jitsi at a glance

Last 12 months
2
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202510
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

jitsi-meet 3 @jitsi/electron-sdk 1
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.4
    CVE-2026-92299

    @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

    @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sou…

    Jitsi @jitsi/electron-sdk
  • Low 2.7
    CVE-2025-64754

    Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

    Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are…

    Jitsi jitsi-meet
  • High 7.5
    CVE-2021-39215

    Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms

    Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain author…

    Jitsi jitsi-meet
  • Medium 6.8
    CVE-2021-39205

    DOM-based XSS/Content Spoofing via Prototype Pollution

    Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this …

    Jitsi jitsi-meet