CVE-2025-64754
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-13

Assigner: GitHub, Inc.

Description
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-13
Last Modified
2025-11-13
Generated
2026-06-16
AI Q&A
2025-11-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64754
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jitsi jitsi_meet 2.0.10532
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects Jitsi Meet versions prior to 2.0.10532 and allows attackers to hijack the OAuth authentication window for Microsoft accounts. This means an attacker could potentially interfere with or take control of the authentication process when users log in using their Microsoft credentials.

Impact Analysis

The vulnerability could allow attackers to hijack the OAuth authentication window, potentially leading to unauthorized access or interception of Microsoft account authentication. This could compromise user accounts and lead to unauthorized access to video conferencing sessions or related data.

Mitigation Strategies

Upgrade Jitsi Meet to version 2.0.10532 or later, as this version contains the fix for the OAuth authentication window hijacking vulnerability. No known workarounds are available.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart