Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jitsi/jitsi-meet
master @ cb7bf94
77
Fixes
6
CVEs
CRITICAL
Peak severity
18.8%
Coverage
Highlights
Auth Bypass: 38 prior fixes. Scrutinize any change in this area.
resources/prosody-plugins/token/util.lib.lua: most-fixed (10 issues). Treat as high-risk during review.
40 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical token-bypass logic was fixed by ensuring asymmetric signature algorithms from the RS family are strictly verified and rejecting insecure 'none' or empty algorithms during JWT decoding. Attackers could previously bypass authorization entirely using self-signed or unsigned tokens.
Authentication Bypass: Historically, token verification failures did not halt room creation or joining because Prosody event hooks returned nil instead of halting propagation, allowing unauthenticated users to gain access.
Prototype Pollution: Parsing parameters from URLs permitted prototype pollution via object injection when nested path components bypassed shallow blocklists. This was resolved by using @hapi/bourne for parsing and validating all nested properties.