Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.
The error concerns the handleDataChannelChat(dataMessage) function, responsible for handling messages transmitted through the data channel. Improper access control (CWE-924 — improper enforcement of message or data structure) allows an attacker to manipulate the message sender field without any authentication. As a result, it is possible to send a chat message that will be displayed on the recipient's side as coming from any person indicated by the attacker.
An attacker can impersonate any participant in a video conference session and send forged chat messages on their behalf, which threatens communication integrity and may lead to social engineering attacks and breach of participant trust.
Mirotalk should be updated to a version containing commit c21d58 or newer. It is recommended to download the current source code from the official producer repository on GitHub.
Mirotalk in versions before commit c21d58
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N