CVE-2021-39215

Executive Summary

CVE-2021-39215 is an authentication bypass vulnerability in Jitsi Meet, a widely adopted open-source video conferencing platform, affecting all versions prior to 2.0.5963. A Prosody module (the XMPP server component) improperly permits the use of symmetric cryptographic algorithms during JSON Web Token (JWT) validation, which enables tokens forged by arbitrary, unauthorized sources to successfully authenticate users into protected conference rooms. The vulnerability carries a CVSS score of 7.5 (High), and exploitation requires only network access with no user interaction or privileges, posing a direct threat to any Jitsi deployment that relies on JWT-based authentication to secure its meeting rooms.

Technical Analysis

Jitsi Meet leverages Prosody, an XMPP server, as its signaling backbone. To manage authenticated access to conference rooms, the deployment can be configured to require JSON Web Tokens (JWTs). These tokens are typically issued by a trusted identity provider (IdP) and signed with a server-specific secret or asymmetric key pair. The Prosody module responsible for validating incoming JWTs evaluates the token signature before granting access to the requested room.

The vulnerability resides in the JWT validation logic of this Prosody module. Specifically, the module permits the use of symmetric algorithms — such as HS256 (HMAC with SHA-256) — during signature verification. When a server is configured to use asymmetric cryptography (e.g., RS256) for token issuance, the validation routine should reject tokens signed with any algorithm other than the expected one. However, in the affected versions, the module does not enforce this algorithm restriction. An attacker can craft a JWT and sign it using a symmetric key composed of the public key string of the target server (or a known/guessable public-key value). Because the verification logic mistakenly treats the symmetric signature as valid, the forged token is accepted.

The root cause is a classic algorithm-substitution attack — a known cryptographic weakness in flawed JWT implementations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attacker needs only network connectivity to the Jitsi server, requires no authentication, and does not need user interaction to trigger the flaw. The confidentiality impact is rated High, while integrity and availability impact are scored as None by the CNA; however, an attacker who bypasses room-level authentication gains unauthorized access to private meetings, potentially intercepting sensitive audio, video, and chat communications.

No public exploit code was available at the time of this report, and the NVD description does not provide function names, module identifiers, or specific code paths beyond referencing "a Prosody module" and the algorithm validation weakness. The technical assessment is therefore based on the documented behavior of the vulnerability class (JWT algorithm confusion) as applied to the Jitsi Meet architecture.

Exploitation Scenarios

The attack chain for CVE-2021-39215 is inferred from the vulnerability class (JWT algorithm confusion) combined with the NVD description. No public PoC was available at the time of reporting; the following scenario represents the plausible exploitation pathway.

Step 1 — Reconnaissance and Target Identification: An attacker identifies a Jitsi Meet server that authenticates room access via JWT. This may be discovered through Shodan queries targeting open ports commonly used by Jitsi (e.g., 5222 for XMPP, 5280 for BOSH, or the web interface on 443/8443). The attacker probes the web frontend for authentication pages or API endpoints that return JWT validation errors, revealing the presence of token-based access control.

Step 2 — Crafting the Forgery: The attacker obtains the server's RSA public key. This key may be exposed via a public JWKS endpoint (commonly found in Jitsi deployments at /.well-known/jwks.json or similar), or it may be retrievable from the Jitsi Meet frontend configuration if the server leaks its publicKey or applicationId values in the client-side JavaScript. Armed with the public key string, the attacker constructs a JWT whose header claims an alg value of HS256 (symmetric HMAC) instead of RS256. The payload of the token is crafted to include a valid room claim targeting the protected meeting room and a sub or iss claim that the Prosody server will accept, along with an appropriate expiration time.

Step 3 — Token Submission: The attacker signs the JWT header/payload pair using the server's public key string as the HMAC-SHA256 secret. The attacker then presents this forged token to the Jitsi Meet authentication endpoint, either by embedding it in the web client's session initialization flow, sending it directly to the Prosody XMPP module, or using it to establish a WebSocket/BOSH session. Because the vulnerable Prosody module accepts the symmetric verification, the token is authenticated successfully.

Step 4 — Post-Exploitation Impact: The attacker gains full access to the protected room and can join the conference without being intercepted by the authentication layer. Once inside, the attacker can observe/listen to ongoing confidential discussions, record sessions, extract shared files, and potentially enumerate other users connected to the room. Additionally, the attacker could repeat the procedure across multiple rooms, gaining broad unauthorized access to all JWT-protected spaces on the affected server.

Impact Assessment

The primary business impact of CVE-2021-39215 is unauthorized disclosure of sensitive communications. Jitsi Meet is commonly deployed for internal corporate meetings, board sessions, telehealth consultations, legal consultations, and educational settings — all of which may transmit confidential or regulated information. A successful exploit grants the attacker access to protected rooms without credentials, effectively neutralizing the platform's primary access-control mechanism.

The CVSS score of 7.5 (High) reflects the minimal preconditions for exploitation: network-only attack vector, low complexity, no privileges required, and no user interaction. The confidentiality impact is rated High (C:H in the vector), meaning full disclosure of meeting contents is possible. While the CNA-rated integrity and availability impacts are None, the practical consequences include potential session hijacking or disruption if the attacker leverages the forged token to escalate further.

The blast radius extends to all Jitsi Meet instances running versions below 2.0.5963 where JWT authentication is enabled. Self-hosted deployments are particularly exposed, as they may not be automatically updated. Managed Jitsi-as-a-service offerings (e.g., 8x8's Jitsi-based services) are affected only until their backend versions are upgraded. The EPSS score of 0.01235 (66.3rd percentile) indicates a moderate expected exploitation probability but not a widespread current exploitation campaign.

Detection Guidance

Sigma Rule

title: Authentication Bypass via JWT Algorithm Confusion - Jitsi Meet
id: 4f8a2c7e-3b9d-4e6a-9f2c-5d1a8b3e6f90
status: experimental
description: Detects log entries indicating JWT authentication bypass attempts using symmetric algorithms (HS256) against Jitsi Meet's Prosody module
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39215
tags:
    - attack.t1190
    - cve.2021.39215
logsource:
    product: jitsi
    service: prosody
detection:
    selection:
        - category: 'auth'
          message|contains|all:
              - 'jwt'
              - 'HS256'
              - 'auth'
        - category: 'security'
          message|contains|all:
              - 'token'
              - 'algorithm'
              - 'valid'
    condition: selection
falsepositives:
    - Legitimate tokens signed with HS256 when the server is configured for symmetric-only keys (not recommended)
    - Misconfigured deployments using symmetric keys for classroom scenarios
level: high

YARA Rule

rule CVE_2021_39215_Jitsi_JWT_Forgery
{
    meta:
        author = "Valter SiT Threat Intel"
        description = "Detects JWT strings with HS256 algorithm and payload characteristics indicative of CVE-2021-39215 exploitation attempts"
        cve = "CVE-2021-39215"
        date = "2025-04-04"
        severity = "high"

    strings:
        $alg_hs = /"alg"\s*:\s*"HS256"/ nocase
        $room_claim = /"room"\s*:\s*"[^"]{3,}"/ nocase
        $iss_claim = /"iss"\s*:\s*"[^"]{3,}"/ nocase
        $jwt_header = "eyJ" ascii
        $dot_sep = "." ascii

    condition:
        uint16(0) == 0x0D0A and
        $alg_hs and $room_claim and
        $jwt_header and #jwt_header > 1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-39215 Jitsi Meet JWT Authentication Bypass Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/xmpp"; content:"jwt"; content:"HS256"; http.header; content:"Content-Type"; content:"application/json"; classtype:attempted-admin; sid:202139215; rev:1; metadata:created_at 2025_04_04, cve CVE-2021-39215;)

Elastic Detection

rule:
  - name: "Jitsi JWT Authentication Bypass Attempt"
    description: "Detects JSON payloads containing HS256 algorithm and room access tokens sent to Jitsi XMPP endpoints"
    tags: ["CVE-2021-39215", "Authentication Bypass"]
    queries:
      - event.dataset: "jitsi.prosody"
        process.command_line: "*auth*"
        message: "*HS256*"
      - event.dataset: "nginx.access"
        url.path: "/xmpp*"
        request.body: "*jwt*"
        request.body: "*HS256*"

EQL form:

sequence by source.ip
  [network where event.action == "connection_attempted" and destination.port in (5222, 5280)]
  [http where http.request.method == "POST" and url.path == "/xmpp" and http.request.body like "*HS256*" and http.request.body like "*room*"]

Splunk SPL Query

index=web sourcetype=nginx:access path="/xmpp*" 
| where _raw like "%HS256%" AND _raw like "%jwt%"
| stats count by src_ip, dest_host, _time
| sort - count
| head 50

Additional query for Prosody logs:

index=main sourcetype=prosody category=auth 
| search "jwt" OR "token" OR "algorithm" "valid" 
| where _raw like "%HS256%"
| table _time, host, user, src_ip, message

Wazuh OSSEC Rule

<group name="jitsi,">
    <rule id="392150" level="12">
        <decoded>jitsi</decoded>
        <match>HS256</match>
        <match>jwt|token</match>
        <match>auth|valid</match>
        <description>CVE-2021-39215: Possible JWT algorithm confusion authentication bypass in Jitsi Meet</description>
        <group>authentication_failures,attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2021-39215 is rated 2/4 (CLAIMED), meaning a single source (the CNA) asserts that the vulnerability is fixed in Jitsi Meet 2.0.5963, but this has not been independently confirmed through vendor advisory verification or third-party analysis.

Immediate mitigations (if unable to patch immediately):

1. Disable JWT-based authentication on the Jitsi Meet server, reverting to alternative access controls (e.g., lobby approval flows) until patching is complete — noting this reduces security for rooms that rely on token gating.
2. Restrict network access to Prosody authentication endpoints (ports 5222, 5280, and the BOSH/WebSocket paths on 443/8443) to trusted IP ranges only, limiting the attack surface.
3. Monitor authentication logs for anomalies, particularly tokens bearing the HS256 algorithm header when the server is configured for asymmetric (RS256/ES256) key use.

Patch/upgrade steps:

1. Upgrade Jitsi Meet to version 2.0.5963 or later, which corrects the Prosody module's JWT validation to strictly enforce the expected signing algorithm (rejecting symmetric algorithms when asymmetric keys are configured).
2. After upgrading, validate that JWT authentication still functions for legitimate users and that the server rejects deliberately malformed tokens signed with HS256.

Long-term hardening:

1. Regularly update all Jitsi components (Prosody, Jicofo, JVB, web frontend) to the latest stable release.
2. Configure JWT validation with an explicit allowlist of permitted signing algorithms (allowed_algs or equivalent) rather than relying on defaults.
3. Enforce the use of asymmetric algorithms (RS256/ES256) with a securely guarded private key for all token issuance.
4. Rotate JWT signing keys on a defined cadence and invalidate any tokens issued with legacy algorithms.
5. Subscribe to Jitsi's security announcement channels for early disclosure of future vulnerabilities.

References

1. NVD Entry — CVE-2021-39215: https://nvd.nist.gov/vuln/detail/CVE-2021-39215
2. Jitsi Meet GitHub Repository (release history and version tags): https://github.com/jitsi/jitsi-meet
3. Jitsi Security Advisory (via CNA notification, referenced only in NVD record): No direct URL available; validate against vendor release notes at https://github.com/jitsi/jitsi-meet/releases
4. CISA KEV Catalog (CVE-2021-39215 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

As of this report, there is no evidence of active exploitation in the wild for CVE-2021-39215, and no public exploit code or PoC has been disclosed. The vulnerability was not added to CISA's Known Exploited Vulnerabilities catalog. Enterprise security teams should still prioritize patching given the high CVSS score and the sensitive nature of communications handled by Jitsi Meet deployments.