CVE-2026-108831

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-259, CWE-798

Impact

Authenticated remote attackers can gain unauthorized access to Janus Admin API capabilities using hardcoded credentials. They need network access to the Admin API web demo interface.

Root cause

The Admin API demo JavaScript file (html/demos/admin.js) contains hardcoded credentials.

Affected systems

meetecho janus-gateway up to 1.4.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade to a fixed version beyond 1.4.2 once available; immediately disable or remove the html/demos/admin.js file and restrict network access to the Janus Admin API port.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108831