CVE-2026-108830
meetecho janus-gateway VideoRoom janus_videoroom.c race condition
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
meetecho janus-gateway VideoRoom janus_videoroom.c race condition
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-108830- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 3.6
AV:N/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2026-97353
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
EUVD-2026-97353- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r9x7-54rc-vq7h
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown...
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
GHSA-r9x7-54rc-vq7h- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-108830- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 3.6 Low
AV:N/AC:H/Au:S/C:N/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
meetecho janus-gateway VideoRoom janus_videoroom.c race condition
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-108830- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-108830
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
DEBIAN-CVE-2026-108830- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-108830
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
UBUNTU-CVE-2026-108830- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
janusDebian:12 |
All versions, plus listed versions 1.1.2-11.1.2-1.11.1.2-1.21.1.2-21.1.2-3 Show 6 moreShow less1.1.2-3.11.1.2-41.4.1+ds-11.4.1+ds-21.4.1+ds-31.4.1+ds-4 |
None known |
janusDebian:14 |
All versions, plus listed versions 0.10.0-10.10.1-10.10.2-10.10.3-10.10.4-1 Show 45 moreShow less0.10.5-10.10.6-10.10.7-10.10.8-10.10.8-20.10.9-10.10.9-20.11.1-10.11.2-10.11.3-1~exp10.11.4-10.11.5-10.11.5-20.11.5-30.11.5-40.11.6-10.11.6-1~bpo11+10.11.7-10.11.7-1~bpo11+10.11.8-10.11.8-1~bpo11+10.11.8-20.11.8-30.11.8-3~bpo11+10.12.0-10.2.2+dfsg-10.2.2+dfsg-20.2.2+dfsg-30.2.2+dfsg-40.2.2+dfsg-5~exp10.2.2+dfsg-5~exp20.2.2+dfsg-5~exp30.2.3-10.2.4-10.2.4-20.2.5-10.2.6-10.3.1-10.4.2-10.4.4-10.4.5-10.4.5-20.5.0-10.6.0-10.6.0-2 |
None known |
janusUbuntu:18.04:LTS |
All versions, plus listed versions 0.2.4-20.2.5-10.2.6-10.2.6-1build10.2.6-1build2 |
None known |
janusUbuntu:20.04:LTS |
All versions, plus listed versions 0.7.3-20.7.3-2build1 |
None known |
janusUbuntu:22.04:LTS |
All versions, plus listed versions 0.11.2-10.11.5-10.11.5-1ubuntu10.11.5-30.11.5-4 Show 5 moreShow less0.11.6-10.11.7-10.11.8-10.11.8-20.11.8-3 |
None known |
janusUbuntu:24.04:LTS |
All versions, plus listed versions 1.1.2-1build21.1.2-1build31.1.2-1build41.1.2-1build5 |
None known |
janusUbuntu:26.10 |
All versions, plus listed versions 1.1.2-41.4.1+ds-41.4.1+ds-4build1 |
None known |
janusUbuntu:26.04:LTS |
All versions, plus listed versions 1.1.2-31.1.2-3.11.1.2-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108830 is a low vulnerability (CVSS 2.3) in Meetecho Janus-gateway, published October 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.
References
vuldb.com/vuln/416606
github.com/meetecho/janus-gateway/blob/master/src/plugins/janus_videoroom.c
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-108830
security-tracker.debian.org/tracker/CVE-2026-108830
ubuntu.com/security/CVE-2026-108830
cve.org/CVERecord?id=CVE-2026-108830
Left out here: 36 versions. The JSON record has them.