{"affected":[{"product":"MiroTalk P2P","source":"CNA: VulDB","vendor":"miroslavpejic85","versions":[{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"affected","version":"2.0.3"},{"status":"affected","version":"2.0.4"},{"status":"affected","version":"2.0.5"},{"status":"affected","version":"2.0.6"},{"status":"affected","version":"2.0.7"},{"status":"affected","version":"2.0.8"},{"status":"affected","version":"2.0.9"},{"status":"affected","version":"2.0.10"},{"status":"affected","version":"2.0.11"},{"status":"affected","version":"2.0.12"},{"status":"affected","version":"2.0.13"},{"status":"affected","version":"2.0.14"},{"status":"affected","version":"2.0.15"},{"status":"affected","version":"2.0.16"},{"status":"affected","version":"2.0.17"},{"status":"affected","version":"2.0.18"},{"status":"affected","version":"2.0.19"},{"status":"affected","version":"2.0.20"},{"status":"affected","version":"2.0.21"},{"status":"affected","version":"2.0.22"},{"status":"affected","version":"2.0.23"},{"status":"affected","version":"2.0.24"},{"status":"affected","version":"2.0.25"},{"status":"affected","version":"2.0.26"},{"status":"affected","version":"2.0.27"},{"status":"affected","version":"2.0.28"},{"status":"affected","version":"2.0.29"},{"status":"affected","version":"2.0.30"},{"status":"affected","version":"2.0.31"},{"status":"affected","version":"2.0.32"},{"status":"affected","version":"2.0.33"},{"status":"affected","version":"2.0.34"},{"status":"affected","version":"2.0.35"},{"status":"affected","version":"2.0.36"},{"status":"affected","version":"2.0.37"},{"status":"affected","version":"2.0.38"},{"status":"affected","version":"2.0.39"},{"status":"affected","version":"2.0.40"},{"status":"affected","version":"2.0.41"},{"status":"affected","version":"2.0.42"},{"status":"affected","version":"2.0.43"},{"status":"affected","version":"2.0.44"},{"status":"affected","version":"2.0.45"},{"status":"affected","version":"2.0.46"},{"status":"affected","version":"2.0.47"},{"status":"affected","version":"2.0.48"},{"status":"affected","version":"2.0.49"},{"status":"affected","version":"2.0.50"},{"status":"affected","version":"2.0.51"},{"status":"affected","version":"2.0.52"},{"status":"affected","version":"2.0.53"},{"status":"affected","version":"2.0.54"},{"status":"affected","version":"2.0.55"},{"status":"affected","version":"2.0.56"},{"status":"affected","version":"2.0.57"},{"status":"affected","version":"2.0.58"},{"status":"affected","version":"2.0.59"},{"status":"affected","version":"2.0.60"},{"status":"affected","version":"2.0.61"},{"status":"affected","version":"2.0.62"},{"status":"affected","version":"2.0.63"},{"status":"affected","version":"2.0.64"},{"status":"affected","version":"2.0.65"},{"status":"affected","version":"2.0.66"},{"status":"affected","version":"2.0.67"},{"status":"affected","version":"2.0.68"},{"status":"affected","version":"2.0.69"},{"status":"affected","version":"2.0.70"},{"status":"affected","version":"2.0.71"},{"status":"affected","version":"2.0.72"},{"status":"affected","version":"2.0.73"},{"status":"affected","version":"2.0.74"},{"status":"affected","version":"2.0.75"},{"status":"affected","version":"2.0.76"},{"status":"affected","version":"2.0.77"},{"status":"affected","version":"2.0.78"},{"status":"affected","version":"2.0.79"},{"status":"affected","version":"2.0.80"},{"status":"affected","version":"2.0.81"},{"status":"affected","version":"2.0.82"},{"status":"affected","version":"2.0.83"},{"status":"affected","version":"2.0.84"},{"status":"affected","version":"2.0.85"},{"status":"affected","version":"2.0.86"},{"status":"affected","version":"2.0.87"},{"status":"unaffected","version":"2.1.38"}]}],"cveId":"CVE-2026-121535","cwes":["CWE-307","CWE-799"],"description":"A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.","epss":{"date":"2026-11-04","percentile":0.44397,"score":0.00521},"exploits":[{"kind":"exploit","source":"CNA: VulDB","url":"https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"}],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},{"score":3.7,"severity":"low","source":"CNA: VulDB","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.1"},{"score":3.7,"severity":"low","source":"CNA: VulDB","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C","version":"3.0"},{"score":2.6,"severity":"low","source":"CNA: VulDB","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C","version":"2.0"},{"score":2.9,"severity":"low","source":"NVD: cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":3.7,"severity":"low","source":"NVD: cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":2.6,"severity":"low","source":"NVD: cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","version":"2.0"}],"modifiedAt":1793818614511,"publishedAt":1793744119841,"references":[{"source":"CNA: VulDB","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/430291"},{"source":"CNA: VulDB","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/430291/cti"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-121535"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1019995"},{"source":"CNA: VulDB","tags":["related"],"url":"https://github.com/waterhunter2000-svg/vulnerability-reports"},{"source":"CNA: VulDB","tags":["broken-link"],"url":"https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36"},{"source":"CNA: VulDB","tags":["exploit"],"url":"https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"},{"source":"CNA: VulDB","tags":["patch"],"url":"https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"},{"source":"cna@vuldb.com","tags":[],"url":"https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"},{"source":"cna@vuldb.com","tags":[],"url":"https://github.com/miroslavpejic85/mirotalk/security/advisories/GHSA-x2r2-j5hf-hp36"},{"source":"cna@vuldb.com","tags":[],"url":"https://github.com/waterhunter2000-svg/vulnerability-reports"},{"source":"cna@vuldb.com","tags":[],"url":"https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/04-mirotalk-checkpassword-oracle.md"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/cve/CVE-2026-121535"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/submit/1019995"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/430291"},{"source":"cna@vuldb.com","tags":[],"url":"https://vuldb.com/vuln/430291/cti"}],"remediation":[{"kind":"fix","source":"CNA: VulDB","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/miroslavpejic85/mirotalk/commit/55bec1d05f931d2e43633d6d0b7274f79ec719dd"}],"revision":"4139e4cc3774fbfd4b53bf36797f843c66972c0a2509a79bdae6af6671643271","sources":[{"modifiedAt":1793818614511,"name":"CNA: VulDB","retrievedAt":1793819391228,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121535"},{"modifiedAt":1793747854687,"name":"NVD","retrievedAt":1793751779702,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121535"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793819404362,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-121535"}],"ssvc":{"assessedAt":1793818606432,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication","updatedAt":1793819404362}