Search
Find a vulnerability
Search criteria
4 vulnerabilities by miroslavpejic85
CVE-2026-121539 (GCVE-0-2026-121539)
Vulnerability from nvd – Published: 2026-11-03 22:30 – Updated: 2026-11-03 22:30 X_Open Source
VLAI
EPSS
VEX
Title
miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control
Summary
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430300 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430300/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121539 | third-party-advisory |
| https://vuldb.com/submit/1019996 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/miroslavpejic85/mirotalk/commi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miroslavpejic85 | MiroTalk P2P |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 Affected: 2.0.65 Affected: 2.0.66 Affected: 2.0.67 Affected: 2.0.68 Affected: 2.0.69 Affected: 2.0.70 Affected: 2.0.71 Affected: 2.0.72 Affected: 2.0.73 Affected: 2.0.74 Affected: 2.0.75 Affected: 2.0.76 Affected: 2.0.77 Affected: 2.0.78 Affected: 2.0.79 Affected: 2.0.80 Affected: 2.0.81 Affected: 2.0.82 Affected: 2.0.83 Affected: 2.0.84 Affected: 2.0.85 Affected: 2.0.86 Affected: 2.0.87 Affected: 2.1.0 Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 Affected: 2.1.28 Affected: 2.1.29 Affected: 2.1.30 Affected: 2.1.31 Affected: 2.1.32 Affected: 2.1.33 Affected: 2.1.34 Affected: 2.1.35 Affected: 2.1.36 Affected: 2.1.37 Affected: 2.1.38 Unaffected: 2.1.39 cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:*"
],
"modules": [
"Socket IO Handler"
],
"product": "MiroTalk P2P",
"vendor": "miroslavpejic85",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
},
{
"status": "affected",
"version": "2.0.65"
},
{
"status": "affected",
"version": "2.0.66"
},
{
"status": "affected",
"version": "2.0.67"
},
{
"status": "affected",
"version": "2.0.68"
},
{
"status": "affected",
"version": "2.0.69"
},
{
"status": "affected",
"version": "2.0.70"
},
{
"status": "affected",
"version": "2.0.71"
},
{
"status": "affected",
"version": "2.0.72"
},
{
"status": "affected",
"version": "2.0.73"
},
{
"status": "affected",
"version": "2.0.74"
},
{
"status": "affected",
"version": "2.0.75"
},
{
"status": "affected",
"version": "2.0.76"
},
{
"status": "affected",
"version": "2.0.77"
},
{
"status": "affected",
"version": "2.0.78"
},
{
"status": "affected",
"version": "2.0.79"
},
{
"status": "affected",
"version": "2.0.80"
},
{
"status": "affected",
"version": "2.0.81"
},
{
"status": "affected",
"version": "2.0.82"
},
{
"status": "affected",
"version": "2.0.83"
},
{
"status": "affected",
"version": "2.0.84"
},
{
"status": "affected",
"version": "2.0.85"
},
{
"status": "affected",
"version": "2.0.86"
},
{
"status": "affected",
"version": "2.0.87"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
},
{
"status": "affected",
"version": "2.1.28"
},
{
"status": "affected",
"version": "2.1.29"
},
{
"status": "affected",
"version": "2.1.30"
},
{
"status": "affected",
"version": "2.1.31"
},
{
"status": "affected",
"version": "2.1.32"
},
{
"status": "affected",
"version": "2.1.33"
},
{
"status": "affected",
"version": "2.1.34"
},
{
"status": "affected",
"version": "2.1.35"
},
{
"status": "affected",
"version": "2.1.36"
},
{
"status": "affected",
"version": "2.1.37"
},
{
"status": "affected",
"version": "2.1.38"
},
{
"status": "unaffected",
"version": "2.1.39"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:30:15.617Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430300 | miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430300"
},
{
"name": "VDB-430300 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430300/cti"
},
{
"name": "CVE-2026-121539 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121539"
},
{
"name": "Submit #1019996 | miroslavpejic85 MiroTalk P2P 2.0.87 Improper Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019996"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:44:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121539",
"datePublished": "2026-11-03T22:30:15.617Z",
"dateReserved": "2026-11-03T14:38:55.431Z",
"dateUpdated": "2026-11-03T22:30:15.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121535 (GCVE-0-2026-121535)
Vulnerability from nvd – Published: 2026-11-03 22:15 – Updated: 2026-11-03 22:15 X_Open Source
VLAI
EPSS
VEX
Title
miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication
Summary
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.
Severity
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430291 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430291/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121535 | third-party-advisory |
| https://vuldb.com/submit/1019995 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/miroslavpejic85/mirotalk/secur… | broken-link |
| https://github.com/waterhunter2000-svg/vulnerabil… | exploit |
| https://github.com/miroslavpejic85/mirotalk/commi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miroslavpejic85 | MiroTalk P2P |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 Affected: 2.0.65 Affected: 2.0.66 Affected: 2.0.67 Affected: 2.0.68 Affected: 2.0.69 Affected: 2.0.70 Affected: 2.0.71 Affected: 2.0.72 Affected: 2.0.73 Affected: 2.0.74 Affected: 2.0.75 Affected: 2.0.76 Affected: 2.0.77 Affected: 2.0.78 Affected: 2.0.79 Affected: 2.0.80 Affected: 2.0.81 Affected: 2.0.82 Affected: 2.0.83 Affected: 2.0.84 Affected: 2.0.85 Affected: 2.0.86 Affected: 2.0.87 Unaffected: 2.1.38 cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:*"
],
"modules": [
"Room Action Handler"
],
"product": "MiroTalk P2P",
"vendor": "miroslavpejic85",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
},
{
"status": "affected",
"version": "2.0.65"
},
{
"status": "affected",
"version": "2.0.66"
},
{
"status": "affected",
"version": "2.0.67"
},
{
"status": "affected",
"version": "2.0.68"
},
{
"status": "affected",
"version": "2.0.69"
},
{
"status": "affected",
"version": "2.0.70"
},
{
"status": "affected",
"version": "2.0.71"
},
{
"status": "affected",
"version": "2.0.72"
},
{
"status": "affected",
"version": "2.0.73"
},
{
"status": "affected",
"version": "2.0.74"
},
{
"status": "affected",
"version": "2.0.75"
},
{
"status": "affected",
"version": "2.0.76"
},
{
"status": "affected",
"version": "2.0.77"
},
{
"status": "affected",
"version": "2.0.78"
},
{
"status": "affected",
"version": "2.0.79"
},
{
"status": "affected",
"version": "2.0.80"
},
{
"status": "affected",
"version": "2.0.81"
},
{
"status": "affected",
"version": "2.0.82"
},
{
"status": "affected",
"version": "2.0.83"
},
{
"status": "affected",
"version": "2.0.84"
},
{
"status": "affected",
"version": "2.0.85"
},
{
"status": "affected",
"version": "2.0.86"
},
{
"status": "affected",
"version": "2.0.87"
},
{
"status": "unaffected",
"version": "2.1.38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:15:19.841Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430291 | miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430291"
},
{
"name": "VDB-430291 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430291/cti"
},
{
"name": "CVE-2026-121535 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121535"
},
{
"name": "Submit #1019995 | miroslavpejic85 MiroTalk P2P 2.0.87 Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019995"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:43:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121535",
"datePublished": "2026-11-03T22:15:19.841Z",
"dateReserved": "2026-11-03T14:34:55.076Z",
"dateUpdated": "2026-11-03T22:15:19.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121539 (GCVE-0-2026-121539)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:30 – Updated: 2026-11-03 22:30 X_Open Source
VLAI
EPSS
VEX
Title
miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control
Summary
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430300 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430300/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121539 | third-party-advisory |
| https://vuldb.com/submit/1019996 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/miroslavpejic85/mirotalk/commi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miroslavpejic85 | MiroTalk P2P |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 Affected: 2.0.65 Affected: 2.0.66 Affected: 2.0.67 Affected: 2.0.68 Affected: 2.0.69 Affected: 2.0.70 Affected: 2.0.71 Affected: 2.0.72 Affected: 2.0.73 Affected: 2.0.74 Affected: 2.0.75 Affected: 2.0.76 Affected: 2.0.77 Affected: 2.0.78 Affected: 2.0.79 Affected: 2.0.80 Affected: 2.0.81 Affected: 2.0.82 Affected: 2.0.83 Affected: 2.0.84 Affected: 2.0.85 Affected: 2.0.86 Affected: 2.0.87 Affected: 2.1.0 Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 Affected: 2.1.28 Affected: 2.1.29 Affected: 2.1.30 Affected: 2.1.31 Affected: 2.1.32 Affected: 2.1.33 Affected: 2.1.34 Affected: 2.1.35 Affected: 2.1.36 Affected: 2.1.37 Affected: 2.1.38 Unaffected: 2.1.39 cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:*"
],
"modules": [
"Socket IO Handler"
],
"product": "MiroTalk P2P",
"vendor": "miroslavpejic85",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
},
{
"status": "affected",
"version": "2.0.65"
},
{
"status": "affected",
"version": "2.0.66"
},
{
"status": "affected",
"version": "2.0.67"
},
{
"status": "affected",
"version": "2.0.68"
},
{
"status": "affected",
"version": "2.0.69"
},
{
"status": "affected",
"version": "2.0.70"
},
{
"status": "affected",
"version": "2.0.71"
},
{
"status": "affected",
"version": "2.0.72"
},
{
"status": "affected",
"version": "2.0.73"
},
{
"status": "affected",
"version": "2.0.74"
},
{
"status": "affected",
"version": "2.0.75"
},
{
"status": "affected",
"version": "2.0.76"
},
{
"status": "affected",
"version": "2.0.77"
},
{
"status": "affected",
"version": "2.0.78"
},
{
"status": "affected",
"version": "2.0.79"
},
{
"status": "affected",
"version": "2.0.80"
},
{
"status": "affected",
"version": "2.0.81"
},
{
"status": "affected",
"version": "2.0.82"
},
{
"status": "affected",
"version": "2.0.83"
},
{
"status": "affected",
"version": "2.0.84"
},
{
"status": "affected",
"version": "2.0.85"
},
{
"status": "affected",
"version": "2.0.86"
},
{
"status": "affected",
"version": "2.0.87"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
},
{
"status": "affected",
"version": "2.1.28"
},
{
"status": "affected",
"version": "2.1.29"
},
{
"status": "affected",
"version": "2.1.30"
},
{
"status": "affected",
"version": "2.1.31"
},
{
"status": "affected",
"version": "2.1.32"
},
{
"status": "affected",
"version": "2.1.33"
},
{
"status": "affected",
"version": "2.1.34"
},
{
"status": "affected",
"version": "2.1.35"
},
{
"status": "affected",
"version": "2.1.36"
},
{
"status": "affected",
"version": "2.1.37"
},
{
"status": "affected",
"version": "2.1.38"
},
{
"status": "unaffected",
"version": "2.1.39"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:30:15.617Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430300 | miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430300"
},
{
"name": "VDB-430300 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430300/cti"
},
{
"name": "CVE-2026-121539 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121539"
},
{
"name": "Submit #1019996 | miroslavpejic85 MiroTalk P2P 2.0.87 Improper Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019996"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miroslavpejic85/mirotalk/commit/4e40471abc48bfc32b4b174b8844716dfc5c1471"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:44:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121539",
"datePublished": "2026-11-03T22:30:15.617Z",
"dateReserved": "2026-11-03T14:38:55.431Z",
"dateUpdated": "2026-11-03T22:30:15.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121535 (GCVE-0-2026-121535)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:15 – Updated: 2026-11-03 22:15 X_Open Source
VLAI
EPSS
VEX
Title
miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication
Summary
A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.
Severity
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430291 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430291/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121535 | third-party-advisory |
| https://vuldb.com/submit/1019995 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/miroslavpejic85/mirotalk/secur… | broken-link |
| https://github.com/waterhunter2000-svg/vulnerabil… | exploit |
| https://github.com/miroslavpejic85/mirotalk/commi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miroslavpejic85 | MiroTalk P2P |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 Affected: 2.0.65 Affected: 2.0.66 Affected: 2.0.67 Affected: 2.0.68 Affected: 2.0.69 Affected: 2.0.70 Affected: 2.0.71 Affected: 2.0.72 Affected: 2.0.73 Affected: 2.0.74 Affected: 2.0.75 Affected: 2.0.76 Affected: 2.0.77 Affected: 2.0.78 Affected: 2.0.79 Affected: 2.0.80 Affected: 2.0.81 Affected: 2.0.82 Affected: 2.0.83 Affected: 2.0.84 Affected: 2.0.85 Affected: 2.0.86 Affected: 2.0.87 Unaffected: 2.1.38 cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:miroslavpejic85:mirotalk_p2p:*:*:*:*:*:*:*:*"
],
"modules": [
"Room Action Handler"
],
"product": "MiroTalk P2P",
"vendor": "miroslavpejic85",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
},
{
"status": "affected",
"version": "2.0.65"
},
{
"status": "affected",
"version": "2.0.66"
},
{
"status": "affected",
"version": "2.0.67"
},
{
"status": "affected",
"version": "2.0.68"
},
{
"status": "affected",
"version": "2.0.69"
},
{
"status": "affected",
"version": "2.0.70"
},
{
"status": "affected",
"version": "2.0.71"
},
{
"status": "affected",
"version": "2.0.72"
},
{
"status": "affected",
"version": "2.0.73"
},
{
"status": "affected",
"version": "2.0.74"
},
{
"status": "affected",
"version": "2.0.75"
},
{
"status": "affected",
"version": "2.0.76"
},
{
"status": "affected",
"version": "2.0.77"
},
{
"status": "affected",
"version": "2.0.78"
},
{
"status": "affected",
"version": "2.0.79"
},
{
"status": "affected",
"version": "2.0.80"
},
{
"status": "affected",
"version": "2.0.81"
},
{
"status": "affected",
"version": "2.0.82"
},
{
"status": "affected",
"version": "2.0.83"
},
{
"status": "affected",
"version": "2.0.84"
},
{
"status": "affected",
"version": "2.0.85"
},
{
"status": "affected",
"version": "2.0.86"
},
{
"status": "affected",
"version": "2.0.87"
},
{
"status": "unaffected",
"version": "2.1.38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:15:19.841Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430291 | miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430291"
},
{
"name": "VDB-430291 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430291/cti"
},
{
"name": "CVE-2026-121535 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121535"
},
{
"name": "Submit #1019995 | miroslavpejic85 MiroTalk P2P 2.0.87 Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019995"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T15:43:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121535",
"datePublished": "2026-11-03T22:15:19.841Z",
"dateReserved": "2026-11-03T14:34:55.076Z",
"dateUpdated": "2026-11-03T22:15:19.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}