CVE-2025-64754

Executive Summary

CVE-2025-64754 is a critical authentication bypass vulnerability in Jitsi Meet, an open-source video conferencing application. The flaw allows an attacker to hijack the OAuth authentication window for Microsoft accounts, potentially enabling unauthorized access to user sessions and sensitive data. The vulnerability affects all versions prior to 2.0.10532. No known workarounds exist, and the vendor has released a patched version. The EPSS score is 0.0%, indicating low exploitation activity at this time, but the risk remains significant due to the nature of the attack vector.

Supply Chain & Package Security

Jitsi Meet is a JavaScript-based application often deployed via Docker or direct installation. The vulnerability resides in the OAuth flow, which is a critical component for Microsoft account integration. Organizations using Jitsi Meet with Microsoft authentication should prioritize patching to version 2.0.10532. No known supply chain compromises have been reported, but the lack of detailed patch information increases the risk of incomplete fixes.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): Required (user must initiate OAuth flow)
• Scope (S): Changed (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): Low (likely)

Threat Level: High. The vulnerability allows session hijacking with minimal user interaction, potentially leading to full account compromise.

Deep Dive & Mechanics

The vulnerability exploits the OAuth 2.0 authentication flow for Microsoft accounts in Jitsi Meet. The attack likely involves:

1. OAuth State Parameter Manipulation: The attacker may intercept or predict the state parameter used in the OAuth flow, allowing them to inject their own authorization code.
2. Redirect URI Hijacking: The attacker could manipulate the redirect URI to point to a malicious endpoint, capturing the authorization code.
3. Session Fixation: By controlling the OAuth window, the attacker can force the victim to authenticate against the attacker's session, effectively hijacking the resulting token.

The attack requires the victim to initiate the OAuth flow (e.g., by clicking "Sign in with Microsoft"). Once the attacker hijacks the window, they can obtain the victim's access token and impersonate them.

Vulnerable vs. Patched Code

No specific code snippets are available. However, the fix in version 2.0.10532 likely involves:

• State Parameter Validation: Ensuring the state parameter is cryptographically random and tied to the user's session.
• Redirect URI Whitelisting: Strictly validating the redirect URI against a whitelist.
• PKCE Enforcement: Implementing Proof Key for Code Exchange (PKCE) to prevent authorization code interception.

Vulnerable Code (Conceptual):

// Vulnerable: Weak state parameter generation
const state = Math.random().toString(36).substring(2);

Patched Code (Conceptual):

// Patched: Cryptographically secure state parameter
const crypto = require('crypto');
const state = crypto.randomBytes(32).toString('hex');

Exploitation & Lab Setup

Red Team

Prerequisites:

• Jitsi Meet instance < 2.0.10532
• Ability to intercept or manipulate network traffic (e.g., using Burp Suite or mitmproxy)
• Victim user with Microsoft account

Exploitation Steps:

1. Set up a malicious server to capture OAuth codes.
2. Craft a phishing link that triggers the OAuth flow with a manipulated state parameter.
3. When the victim clicks the link, the OAuth window opens and redirects to the attacker's server.
4. Capture the authorization code and exchange it for an access token.
5. Use the token to access the victim's Jitsi Meet session.

Example Attack Flow:

# Using mitmproxy to intercept OAuth traffic
mitmproxy --mode transparent --listen-port 8080
# Redirect victim's OAuth request to attacker's server
# Capture code and exchange for token
curl -X POST https://login.microsoftonline.com/common/oauth2/v2.0/token \
  -d "client_id=ATTACKER_CLIENT_ID" \
  -d "code=CAPTURED_CODE" \
  -d "redirect_uri=https://attacker.com/callback" \
  -d "grant_type=authorization_code"

Blue Team

Detection Steps:

1. Monitor for unusual OAuth redirect URIs in logs.
2. Alert on multiple failed OAuth attempts from the same IP.
3. Implement strict CORS policies on the Jitsi Meet server.
4. Use Web Application Firewall (WAF) rules to block suspicious OAuth parameters.

Mitigation:

• Immediately upgrade to Jitsi Meet 2.0.10532.
• If patching is not possible, disable Microsoft OAuth authentication temporarily.
• Enforce multi-factor authentication (MFA) for all accounts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual redirect URIs in OAuth requests (e.g., https://attacker.com/callback)
  • Multiple OAuth authorization code requests from the same IP in a short time
  • Requests to /oauth2/v2.0/authorize with manipulated state parameters

• Host IOCs:

  • Unexpected processes or scripts running on the Jitsi Meet server
  • Modified configuration files related to OAuth (e.g., config.js)

• Log IOCs:

  • Log entries showing state parameter mismatches
  • Failed OAuth token exchanges

Detection Engineering

YARA Rule

rule CVE_2025_64754_OAuth_Hijack {
    meta:
        description = "Detects potential OAuth hijack attempts in Jitsi Meet logs"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64754"
    strings:
        $state_param = /state=[a-zA-Z0-9]{1,10}/  // Weak state parameter
        $redirect_uri = /redirect_uri=https?:\/\/[^\/]+\/callback/
        $error_log = /OAuth error: state mismatch/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-64754 OAuth Hijack Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious OAuth activity in Jitsi Meet logs
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: jitsi_meet
detection:
    selection:
        - event: "OAuth authorization request"
          state: "weak"
        - event: "OAuth token exchange"
          redirect_uri: "https://*"
    condition: selection
falsepositives:
    - Legitimate OAuth flows with custom redirect URIs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64754 OAuth Hijack Attempt"; flow:to_server; content:"/oauth2/v2.0/authorize"; http_uri; content:"state="; http_uri; pcre:"/state=[a-zA-Z0-9]{1,10}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jitsi Meet to version 2.0.10532 or later.
2. If patching is delayed, disable Microsoft OAuth authentication.
3. Review and restrict OAuth redirect URIs to a whitelist.

Long-Term Measures:

• Implement PKCE (Proof Key for Code Exchange) for all OAuth flows.
• Use cryptographically secure random state parameters.
• Regularly audit OAuth configurations and logs.
• Deploy Web Application Firewall (WAF) rules to detect OAuth manipulation.

Valters IT Signature: This report was generated by Valters IT Cyber Threat Intelligence. For further analysis, contact intelligence@valters-it.com.