CVE-2026-108830

4.2Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.2Medium

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-362

Impact

Authenticated remote attackers can cause integrity violations or crash the Janus VideoRoom service. They need network access to the VideoRoom plugin and valid low-privilege credentials.

Root cause

A race condition in src/plugins/janus_videoroom.c allows concurrent requests to compromise state or cause a denial of service.

Affected systems

meetecho janus-gateway up to 1.4.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

Upgrade janus-gateway to a version containing commit 27c0d1af888153e818675b56a4e6267f62d57097 or apply pull request #3678; if patching immediately is not possible, disable the janus.plugin.videoroom plugin.

shell

$ git pull origin master && git checkout 27c0d1af888153e818675b56a4e6267f62d57097

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108830