🎯 New Report #3789570: jitsi-meet: Prosody/Jigasi missing header whitelist in mod filter iq rayo allows arbitrary SIP header injection and Caller ID spoofing
🔺Severity: Low
👽 Reporter: pmgjoe
⭐️ Reputation: 247
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 100
🕐 Submitted: 2026-06-08
⏰ Disclosed: 2026-07-02 15:50:32
📝 Summary: A vulnerability was discovered in the Prosody and Jigasi components of Jitsi Meet. The Prosody filter implemented an incomplete blocklist that allowed authenticated users with outbound-call privileges to inject arbitrary SIP headers, enabling Caller ID spoofing on outgoing SIP calls in environments where Jigasi operates as a trusted SIP peer.
📂 Report JSON File: 3789570
@hackeronereports