CVE-2025-64754 - Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

Back Back to CVE browser

LOW

Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

Published Nov 13, 2025

2.7

LOW

CVSS 4.0

EPSS 0.49%

Description

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.

Affected products

Vendor Jitsi Product Jitsi-Meet Default
unknown
Affected
- < 2.0.10532

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jitsi	Jitsi-Meet	unknown	Affected < 2.0.10532

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-177182
Advisory
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-177182		Advisory
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Nov 13, 2025

Updated Nov 14, 2025

Reserved Nov 10, 2025

Link CVE-2025-64754

CISA Vulnrichment

Updated Nov 14, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-64754

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Nov 13, 2025

Updated Nov 14, 2025

Link EUVD-2025-177182

GitHub

No data