CVE-2024-44730

9.1 criticalEPSS 0.4%

Critical (9.1). EPSS 0.4% chance of exploitation in the next 30 days.

Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-924
Published: 2024-10-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://aware7.com/de/blog/schwachstellen-in-videokonferenzsystemen/
https://github.com/miroslavpejic85
https://github.com/miroslavpejic85/mirotalk
https://github.com/miroslavpejic85/mirotalksfu/blob/main/SECURITY.md

Check your stack JSON