Quick answers
- Is CVE-2025-66824 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66824 being exploited in the wild.
- How severe is CVE-2025-66824?
- High severity, with a CVSS score of 8.7, published 30 December 2025.
- Which products and versions are affected?
- TrueConf Server 5.5.2.10813.
- Is there a fix for CVE-2025-66824?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-66824 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-66824?
- Check whether you run TrueConf Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the meeting_room parameter of TrueConf Server's Create/Edit Conference functionality. User input supplied in the Meeting location field is stored server-side without proper sanitization and then rendered unsafely on the Conference Info page. An authenticated attacker can inject a malicious JavaScript payload via the meeting_room parameter; when a victim visits the Conference Info page, the payload executes in the victim's browser context. The attack can extract API access tokens and user IDs from localStorage, leading to unauthorized API access and account takeover since the platform relies on API tokens rather than session cookies for authentication. The vulnerability requires low privileges (an authenticated user) and user interaction (viewing the conference info page).
Affected products
- TrueConf Server 5.5.2.10813
Timeline
- 2025-11-23: disclosed: Discovered by Morteza Maleki
- 2025-12-30: advisory: CVE-2025-66824 published