Status: Patched
This vulnerability has been verified as resolved and deployed.
Regex room-claim case mutation permits unauthorized protected-meeting access
Summary
Lowercasing a signed Lua pattern changed the room policy after JWT verification
A participant with a legitimate regex-scoped JWT could join a protected room that the issuer's signed pattern did not authorize. A claim such as ^team-%D+$ was transformed into ^team-%d+$, turning a non-digit policy into a digit policy before the MUC join check.
Root cause. Util:verify_room() lowercased the room claim before deciding whether it was a literal room or a Lua pattern. Case conversion is safe for a canonical room identifier, but it mutates pattern operators such as %D, %A, %S, and %W into operators with different meanings.
Remediation evidence. Jitsi opened PR #17803 the day after the disclosure and merged it on 10 September 2026. The patch preserves regex claims byte-for-byte, canonicalizes literal claims separately, requires a full-string match, and adds paired uppercase/lowercase pattern regression tests.
CVSS Score
Vulnerability Location
Source-to-Sink Analysis
The public BOSH/WebSocket session accepts a valid bearer JWT and stores it on the authoritative Prosody session.
Signature, issuer, and audience verification succeeds, after which the signed room expression and regex marker become session policy.
The vulnerable verifier lowercased pattern syntax, so the resulting expression authorized a different set of rooms than the issuer signed.
Impact Analysis
Critical Impact
The attacker crosses the issuer-defined room boundary and joins an existing protected meeting as a participant, gaining its chat, signaling, and media participation path. The finding does not claim moderator privileges or a service-wide outage.
Attack Surface
Public Jitsi BOSH or XMPP WebSocket authentication and MUC join handling in deployments that enable token verification and regex room claims.
Preconditions
The attacker needs an ordinary valid participant JWT containing an affected uppercase Lua pattern class, and a same-tenant room that matches the lowercased pattern but not the signed pattern. No signing key or moderator credential is required.
Proof of Concept
Environment Setup
Run an isolated token-authenticated Jitsi deployment on a vulnerable revision and create the protected room team-123.
Target Configuration
Issue an ordinary participant JWT with room: "^team-%D+$" and context.room.regex: true. The token must otherwise have a valid signature, issuer, audience, and tenant scope.
Exploit Delivery
Authenticate using the legitimate token, then send a normal MUC join presence for team-123@conference.example.test/attacker.
Outcome
PR #17803 keeps regex text unchanged and requires a complete match, so the same join is rejected while genuinely matching rooms remain accessible.
Expected Response:
The vulnerable server returns successful self-presence and conference signaling even though team-123 does not match the signed %D policy.
Run this level of analysis on your repo.
Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.