Description

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T13:17:26.890Z",
  "pubdate": "2026-10-12T13:17:26.890Z",
  "executiveSummary": "A critical security vulnerability exists in meetecho janus-gateway versions up to 1.4.2, specifically within the Admin API interface.\nThe vulnerability is characterized by the presence of hard-coded credentials within the html/demos/admin.js file, which facilitates unauthorized access to administrative functions.\nThe flaw allows a remote, unauthenticated attacker to gain administrative control over the Janus instance by leveraging these credentials.\nGiven that the exploit has been disclosed publicly, the risk of exploitation is significantly elevated for exposed instances.\nSuccessful exploitation results in full administrative access to the Janus-gateway, potentially allowing an attacker to manipulate WebRTC sessions, intercept data streams, or reconfigure server settings.\nOrganizations relying on the default demonstration configuration are at immediate risk, as the hard-coded credentials provide a direct vector for compromise without the need for sophisticated bypass techniques.",
  "technicalDetails": "The vulnerability resides in the administrative interface component of the meetecho janus-gateway, specifically within the client-side JavaScript file located at html/demos/admin.js.\nThe root cause is the inclusion of hard-coded credentials within the source code of the demonstration dashboard intended for the Admin API.\nWhen deployed in an environment accessible to the network, these hard-coded credentials are exposed to any remote user who navigates to the demonstration web interface.\nThe attack flow begins with the discovery of an accessible admin.js file on a Janus-gateway instance. The attacker analyzes the source code to extract the static credentials intended for internal testing or demonstration purposes.\nUpon obtaining these credentials, the attacker initiates a request to the Janus Admin API, supplying the hard-coded values in the authentication handshake. Since the API relies on these credentials for validation, it grants the attacker a valid session token or grants full administrative privileges.\nThis vulnerability is particularly severe because the attack can be executed remotely over the network without requiring any prior system access or user interaction.\nBecause the credentials are stored directly in the file provided with the installation package, any instance of meetecho janus-gateway up to version 1.4.2 that has enabled the demonstration interface is vulnerable if the default configurations have not been modified or removed.\nThe post-exploitation impact includes unauthorized control over the Janus-gateway process. Administrative privileges via the Admin API allow an attacker to destroy active sessions, retrieve system metrics, adjust server configurations, or potentially conduct man-in-the-middle attacks on active WebRTC media streams processed by the server.\nThe public disclosure of the exploit lowers the barrier to entry for attackers, effectively allowing automated scanning and exploitation scripts to identify and compromise vulnerable Janus instances systematically across the internet."
}