The vulnerability arises from hard‑coded credentials embedded in the Admin API's admin.js file, allowing a remote attacker to authenticate as an administrator without knowing the real password. Once authenticated, the attacker can perform privileged administrative actions such as reconfiguring the gateway or exposing sensitive data, effectively breaking confidentiality and integrity of the system.

meetecho Janus Gateway, versions up to and including 1.4.2.

The CVSS score of 5.3 indicates a medium severity. Exploitation is possible remotely without requiring local access, and the vulnerability has been publicly disclosed, suggesting that attackers can readily build or obtain the exploit. EPSS is not available, but the lack of this metric does not diminish the known threat. The vulnerability is not listed in CISA KEV catalog, yet the public nature of the exploit means the risk remains appreciable.