Executive brief
TrueConf Server is a video conferencing and corporate messaging platform used for team collaboration. An HTML injection vulnerability in the conference description field allows attackers with conference creation privileges to inject malicious code that redirects user clicks to attacker-controlled websites, enabling phishing attacks and credential theft.
Technical details
The vulnerability is an HTML injection (CWE-79) in TrueConf Server's conference description field that results from insufficient input sanitization. An authenticated attacker can inject specially crafted HTML, such as invisible anchor tags with CSS classes (conference-routes-container and router-container), which overlay the entire page. When rendered in the Conference Info page, any user click triggers a redirect to an attacker-controlled site. The attack requires conference creation/edit privileges and user interaction (clicking), but does not require additional authentication per click. No patch availability is documented in the advisory.
Affected products
- TrueConf Server 5.5.2.10813
Timeline
- 2025-11-23: disclosed: Vulnerability discovered
- 2025-12-30: advisory: CVE-2025-66823 published