VulnerabilityDeferred

CVE-2025-64754

A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts.

LOW 2.7EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.

CVSS 4.0: 2.7 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-601
Source: security-advisories@github.com

References

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.