Back to Database
Status published
High
CVE-2021-39215
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
Vulnerability Description
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39215
Credits & Attribution
No credits recorded in the NVD database.
References
More from jitsi
View All →CVE-2025-64754
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Low
2.7
CVE-2022-36736
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web...
Medium
6.1
CVE-2021-39205
DOM-based XSS/Content Spoofing via Prototype Pollution
Medium
6.8
CVE-2021-26812
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through...
Medium
6.1
CVE-2020-25019
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron...
High
7.5
Affected Vendor
jitsi
View all reports →Affected Software
jitsi-meet
Vulnerable Versions:
< 2.0.5963
Timeline
Official Publish:
September 15th, 2021
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N