Read the docs
TI-2026-70934 Aliases CVE-2026-108830GHSA-r9x7-54rc-vq7h

Race condition in meetecho janus-gateway VideoRoom plugin

Priority MEDIUM 45CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Meetecho janus-gateway versions 1.4.0, 1.4.1 and 1.4.2 are affected. A race condition (CWE-362) in the VideoRoom plugin source file src/plugins/janus_videoroom.c lets a remote attacker with low privileges interfere with shared resources. The attack is hard to carry out and needs no user interaction, and it can cause limited integrity and availability impact. A public exploit has been made available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
meetechojanus-gateway1.4.0; 1.4.1; 1.4.2—No fix listedCNA
  • janus-gateway Vendormeetecho Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:meetecho:janus-gateway:*:*:*:*:*:*:*:*——meetecho
  • cpe:2.3:a:meetecho:janus-gateway:*:*:*:*:*:*:*:* Versions — — ·meetecho

Remediation

The sources list no fixed version for janus-gateway. Applying the patch 27c0d1af888153e818675b56a4e6267f62d57097 is the recommended action.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108830
  2. 2026-10-12 Alias added: GHSA-r9x7-54rc-vq7h
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 2

Other 1

  • TI-2026-74158 Path traversal in Janus WebRTC Server lets attackers write files CVSS 4.0MEDIUM 6.9
  • TI-2020-10998 An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. CVSS 3.1CRITICAL 9.8
  • TI-2020-10882 An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. CVSS 3.1CRITICAL 9.8
  • TI-2020-10997 An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. CVSS 3.1CRITICAL 9.8
  • TI-2020-08488 An issue was discovered in Janus through 0.9.1. CVSS 3.1CRITICAL 9.8
  • TI-2020-10881 An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences