Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Priority LOW 20CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed jitsi-meet (jitsi): 2.0.10532
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA jitsi-meet (jitsi) Fixed in 2.0.10532
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64754
More jitsi vulnerabilities
- TI-2021-08445 Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the… CVSS 3.1MEDIUM 6.1
- TI-2022-21330 OS command injection in https://github.com/jitsi CVSS 3.1CRITICAL 9.8
- TI-2020-09546 The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default… CVSS 3.1CRITICAL 9.8
- TI-2021-16600 Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms CVSS 3.1HIGH 7.5
- TI-2020-15286 jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron… CVSS 3.1HIGH 7.5
- TI-2021-16590 DOM-based XSS/Content Spoofing via Prototype Pollution CVSS 3.1MEDIUM 6.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences