Executive brief
TrueConf Server is an on-premises video conferencing and messaging platform used by organizations for secure communications. A stored cross-site scripting vulnerability in the Meeting location field allows attackers to inject malicious JavaScript that executes when users view conference information pages. Successful exploitation can lead to theft of API authentication tokens and complete account takeover of affected users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the meeting_room parameter of TrueConf Server's Create/Edit Conference functionality. User input supplied in the Meeting location field is stored server-side without proper sanitization and then rendered unsafely on the Conference Info page. An authenticated attacker can inject a malicious JavaScript payload via the meeting_room parameter; when a victim visits the Conference Info page, the payload executes in the victim's browser context. The attack can extract API access tokens and user IDs from localStorage, leading to unauthorized API access and account takeover since the platform relies on API tokens rather than session cookies for authentication. The vulnerability requires low privileges (an authenticated user) and user interaction (viewing the conference info page).
Affected products
- TrueConf Server 5.5.2.10813
Timeline
- 2025-11-23: disclosed: Discovered by Morteza Maleki
- 2025-12-30: advisory: CVE-2025-66824 published