| शीर्षक | meetecho janus webrtc server admin demo 1.4.2-admin-demo Authentication Issues |
|---|
| विवरण | The bundled admin demo HTML page (html/demos/admin.js) ships with the documented default admin secret hard-coded as 'var secret = janusoverlord' on line 14. This is the same value the operator is expected to configure in janus.jcfg's admin_secret field. If the Admin API is exposed on a non-localhost interface (e.g. admin_http = yes with admin_ip = x.x.x.x), an attacker can authenticate with the documented default and execute any admin command. On the live target x.x.x.x, the Admin API is bound to localhost only, mitigating the public exposure. However, the default credential remains a horizontal-movement risk. CWE-798: Use of Hard-coded Credentials. |
|---|
| स्रोत | ⚠️ https://github.com/meetecho/janus-gateway/blob/master/html/demos/admin.js#L14 |
|---|
| उपयोगकर्ता | qyf20051010 (UID 100545) |
|---|
| सबमिशन | 15/08/2026 09:42 AM (2 महीनों पहले) |
|---|
| संयम | 11/10/2026 01:32 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 416607 [meetecho janus-gateway तक 1.4.2 Admin API html/demos/admin.js कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|