Description

A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-10-12T12:17:14.813Z",
  "pubdate": "2026-10-12T12:17:14.813Z",
  "executiveSummary": "A race condition vulnerability exists within the VideoRoom plugin of meetecho janus-gateway versions up to 1.4.2.\nThis vulnerability, rooted in src/plugins/janus_videoroom.c, permits remote exploitation under specific, high-complexity conditions.\nThe flaw stems from improper synchronization during concurrent operations, potentially leading to unauthorized state manipulation or application instability.\nWhile exploitation is considered difficult and requires high complexity, the public availability of an exploit elevates the risk profile, necessitating prompt action from administrators.\nThe vendor has acknowledged the issue and released a patch, which is the recommended remediation path to secure the gateway.",
  "technicalDetails": "The identified vulnerability resides within the VideoRoom plugin (src/plugins/janus_videoroom.c) of the janus-gateway. The root cause is a race condition, where the internal state management of the VideoRoom plugin fails to maintain atomicity during concurrent requests. In multi-threaded environments typical of high-performance media gateways, race conditions occur when the outcome of a process depends on the non-deterministic timing or sequence of thread execution.\nSpecifically, the vulnerability involves an improper handling of shared resources or state transitions within the VideoRoom component. When multiple signaling or media control messages are processed simultaneously, the lack of sufficient mutual exclusion (mutex) locks or synchronization primitives allows a remote attacker to manipulate the internal state of the session.\nThe attack flow requires an attacker to transmit crafted, concurrent sequences of messages to the VideoRoom plugin. By exploiting the temporal window between the check and the use (TOCTOU) or the interleaving of thread execution, the attacker can force the system into an inconsistent state. Due to the high complexity and the difficult nature of successful exploitation, this attack is not a straightforward buffer overflow or injection; rather, it is a nuanced exploitation of the application's concurrency model.\nThe impact of a successful exploit could potentially include unauthorized access to video sessions, disruption of service (DoS) leading to gateway crashes, or the bypass of intended access control logic within the room management system. The vulnerability is exploitable remotely, meaning no local access to the server environment is strictly required, though it relies on the attacker's ability to interface directly with the Janus API or protocol handlers.\nThe vulnerability affects all janus-gateway versions up to 1.4.2. As there is a publicly available exploit, the risk of automated or targeted exploitation has increased. Post-exploitation, the attacker might maintain a foothold in the session logic or cause repeated service instability, effectively denying legitimate users access to the media bridge."
}