Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-108831: Janus-Gateway admin API uses fixed login, remote attackers can access

CVE-2026-108831 · published 23 days ago

Summary

The admin interface of Janus-Gateway (up to version 1.4.2) contains a JavaScript file with hard‑coded usernames and passwords. This lets anyone on the network log in to the admin console without permission. Update to a newer version or replace the default credentials and restrict access to the admin page.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	meetecho	janus-gateway	1.4.0
Debian:12	debian	janus	All versions
Ubuntu:18.04:LTS	canonical	janus	All versions

Original advisory text

meetecho janus-gateway Admin API admin.js hard-coded credentials

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

References

https://vuldb.com/vuln/416607 Third Party Advisory
https://vuldb.com/vuln/416607/cti Third Party Advisory
https://vuldb.com/cve/CVE-2026-108831 Third Party Advisory
https://vuldb.com/submit/930157 Third Party Advisory
https://vuldb.com/submit/930158 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-108831 Vendor Advisory
https://ubuntu.com/security/CVE-2026-108831 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-108831 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-259Use of Hard-coded Password

CWE-798Use of Hard-coded Credentials

Timeline

Published12 Oct 2026

Updated4 Nov 2026

First seen12 Oct 2026

Sources

CVE-2026-108831 · NVD

CVE-2026-108831 · MITRE

DEBIAN-CVE-2026-108831 · OSV

UBUNTU-CVE-2026-108831 · OSV

Track software like this

Free during beta