🔺Severity: Low
👽 Reporter: a3z4km3
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: null
🕐 Submitted: 2026-07-25
⏰ Disclosed: 2026-08-25 02:09:50
📝 Summary: An unsafe nginx regex pattern was discovered in the
/colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex [a-zA-Z0-9-\\. ] accepted arbitrary domain names and IP addresses for proxy pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.📂 Report JSON File: 3889473
@hackeronereports