CVE-2026-108830
Received Received - Intake

Race Condition in Janus-Gateway VideoRoom Plugin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108830
EUVD
EUVD-2026-97353

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
meetecho janus-gateway 1.4.0
meetecho janus-gateway 1.4.1
meetecho janus-gateway 1.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108830 is a race condition vulnerability in the VideoRoom feature of the Janus Gateway software up to version 1.4.2. It occurs in the src/plugins/janus_videoroom.c file where the system fails to properly limit the number of publishers in a VideoRoom session when they join simultaneously or quickly. The issue allows unauthorized users to exceed the allowed publisher limit.

Detection Guidance

To detect this vulnerability, check if your Janus Gateway version is below 1.4.2. Inspect the VideoRoom plugin logs for race conditions during simultaneous publisher joins. Monitor for unauthorized publisher counts exceeding configured limits.

Impact Analysis

This vulnerability could allow attackers to disrupt VideoRoom sessions by exceeding the maximum number of allowed publishers. This may lead to unauthorized access, degraded performance, or denial of service in the affected system. Exploitation requires high complexity and is difficult but possible remotely.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a race condition in the VideoRoom feature of Janus Gateway, allowing unauthorized publishers to exceed limits. No evidence suggests it impacts data protection or privacy controls required by these standards.

Mitigation Strategies
  • Upgrade Janus Gateway to the patched version (commit 27c0d1af888153e818675b56a4e6267f62d57097) to enforce stricter publisher limits in VideoRoom sessions.
  • Review and adjust VideoRoom configuration to set appropriate maximum publisher limits for your use case.
  • Monitor active sessions and publisher counts in real-time to detect anomalies or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart