Improper Access Control in MiroTalk P2P Socket I/O Server
CVE-2026-121539

5.3MEDIUM

Key Information:

Vendor

Miroslavpejic85

Status
Mirotalk P2p
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121539?

A security vulnerability has been detected in the MiroTalk P2P Socket I/O server, specifically within the CheckPassword function located in app/src/server.js. An unauthorized manipulation of the peer_id argument allows remote attackers to bypass access controls, potentially leading to unauthorized actions within the application. This issue affects versions up to 2.0.87 and 2.1.38. Users are strongly advised to upgrade to version 2.1.39, which includes a critical patch identified by the commit 4e40471abc48bfc32b4b174b8844716dfc5c1471, to mitigate this vulnerability.

Affected Version(s)

MiroTalk P2P 2.0.0

MiroTalk P2P 2.0.1

MiroTalk P2P 2.0.2

References

https://vuldb.com/vuln/430300
vdb-entrytechnical-description
https://vuldb.com/vuln/430300/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-121539
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

waterhunter (VulDB User)
.