Jitsi

9 CVEs across 4 Jitsi products. Browse Jitsi vulnerabilities, severities, and proof-of-concept exploits.

Jitsi products with known CVEs

ProductCVEs
Jitsi3
Jitsi-Meet3
Meet2
Meet Electron1
Jitsi CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-647542025-11-13Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authen…
CVE-2022-43550Critical9.82023-02-09A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow a…
CVE-2022-36736Medium6.12022-09-08Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOT…
CVE-2021-39215High7.52021-09-15Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to valida…
CVE-2021-39205Medium6.82021-09-15Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting proper…
CVE-2021-26812Medium6.12021-04-14Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious U…
CVE-2020-25019High7.52020-08-29jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or http…
CVE-2020-11878Critical9.82020-04-17The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
CVE-2017-5603Medium5.92017-02-09An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th…