# How to secure a self-hosted Jitsi Meet server

> A fresh docker-jitsi-meet server lets anyone create rooms, so the first step is ENABLE_AUTH=1 with guests allowed to join. Generate service passwords with gen-passwords.sh (the old default passw0rd was CVE-2020-11878), keep the Jicofo, videobridge and Jigasi admin ports private, open only 80/tcp, 443/tcp and 10000/udp, turn on Prosody rate limits, and stay on a current stable release so published advisories are fixed.

Source: https://jitsi.help/guides/jitsi-security-hardening/
Updated: October 11, 2026
Publisher: Jitsi Help (https://jitsi.help/)

This is a checklist for administrators of their own Jitsi server. It covers the settings that matter most, in order, with the Docker setting first and the Debian package equivalent where it differs. It is not a full security audit of your environment.

**Applies to:** docker-jitsi-meet `stable-11248` (the latest release as of 2026-10-11) and Debian/Ubuntu packages of the same release.

## The checklist

| # | Control | Default in docker-jitsi-meet | What to do |
|---|---|---|---|
| 1 | Current release | Whatever you installed | Stay on a recent stable release |
| 2 | Service passwords | Empty, services refuse to start | Run `./gen-passwords.sh` once |
| 3 | Who can create rooms | Anyone (`ENABLE_AUTH=0`) | `ENABLE_AUTH=1`, plus `ENABLE_GUESTS=1` if guests may join |
| 4 | Admin interfaces | Jicofo and videobridge REST on `127.0.0.1` only | Keep them private; leave Jigasi REST off |
| 5 | Open ports | 80/443 web, 10000/udp media | Firewall everything else |
| 6 | Login and join rate limits | Off | `PROSODY_ENABLE_RATE_LIMITS=1` |
| 7 | HTTPS | HSTS on | Valid certificate, keep HSTS on |
| 8 | Meeting protection | Lobby available, off until a moderator turns it on | Lobby or passwords for sensitive meetings |

## 1. Stay on a current release

Every Jitsi security advisory so far was fixed in a later release. These are the published GitHub advisories for the Jitsi projects, checked on 2026-10-11:

| Advisory | What | Fixed in |
|---|---|---|
| [CVE-2025-64754](https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78) | Microsoft OAuth sign-in window could be hijacked | jitsi-meet 2.0.10532 |
| [Fail-open E2EE decryption](https://github.com/jitsi/lib-jitsi-meet/security/advisories/GHSA-hg53-vwvc-h58x) and [misleading E2EE cues](https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-8f5r-2qpr-4g34) | End-to-end encryption weaknesses | jitsi-meet 2.0.7830 |
| [Poll vote manipulation](https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-rj5g-9fmh-p5fj) | Participants could tamper with poll votes | See advisory |
| [CVE-2022-0217](https://github.com/jitsi/docker-jitsi-meet/security/advisories/GHSA-68p7-v5gq-3cfm) | Prosody flaw, only with WebSocket XMPP enabled | docker-jitsi-meet stable-6726-2 |
| [Log4j](https://github.com/jitsi/jitsi-videobridge/security/advisories/GHSA-9v3c-r7vg-gpxv) in the videobridge and [Jigasi](https://github.com/jitsi/jigasi/security/advisories/GHSA-c45v-2cgq-fpg6) | Only when callstats was enabled | See advisories |
| [CVE-2021-39215](https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx) | JWT token forgery through symmetric algorithms | jitsi-meet 2.0.5963 |
| [CVE-2021-39205](https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg) | Cross-site scripting through prototype pollution | See advisory |
| [CVE-2020-11878](https://nvd.nist.gov/vuln/detail/CVE-2020-11878) | Default service passwords in Docker | docker-jitsi-meet stable-4384-1 |

Check what you run with `docker compose images` (Docker) or `dpkg -l | grep jitsi` (packages), and upgrade with the matching release files: [upgrading docker-jitsi-meet](/guides/upgrade-jitsi-docker/). Releases since `stable-11146` also run every container as an unprivileged user with a read-only filesystem, which limits what a compromised container can do; see [the rootless upgrade](/guides/upgrade-jitsi-docker-rootless/).

## 2. Use strong service passwords

Jicofo, the videobridge, Jigasi and Jibri log in to Prosody with internal accounts. Before April 2020, docker-jitsi-meet shipped them with the default password `passw0rd`, so anyone could log in as a system account. That is [CVE-2020-11878](https://nvd.nist.gov/vuln/detail/CVE-2020-11878), rated 9.8 critical, fixed in `stable-4384-1`.

Current releases ship no passwords at all. A service whose password is empty stops with a line like:

```text
FATAL ERROR: Jicofo auth password must be set
```

Generate strong random passwords once, in the docker-jitsi-meet folder, before the first start:

```bash
./gen-passwords.sh
```

It writes `openssl rand -hex 16` values into `.env` and keeps a backup in `.env.bak`. Do not reuse these passwords anywhere else, and keep `.env` out of version control.

## 3. Decide who can create meetings

By default anyone who reaches your server can create a room. To allow only signed-in users to start meetings while guests can still join them, set in `.env`:

```ini
ENABLE_AUTH=1
ENABLE_GUESTS=1
AUTH_TYPE=internal
```

`AUTH_TYPE` can also be `jwt` or `ldap`. Step-by-step setups:

- [Username and password (secure domain)](/guides/jitsi-secure-domain-authentication/)
- [JWT tokens from your own app](/guides/jitsi-jwt-authentication/)
- [LDAP and Active Directory](/guides/jitsi-ldap-authentication/)
- [Keycloak, Entra ID and other OIDC providers](/guides/jitsi-keycloak-oidc-sso/)

Recreate the stack after changing `.env` with `docker compose up -d`. On Debian packages, follow the same guides; they cover the package configuration.

## 4. Keep admin interfaces private

docker-jitsi-meet publishes the Jicofo REST port (8888) and the videobridge colibri port (8080) only on `127.0.0.1`, so they are reachable from the server itself but not from the internet. Keep it that way: do not change those port mappings to `0.0.0.0`, and if you need them for monitoring, reach them over a private network or a tunnel. Our [monitoring guide](/guides/jitsi-monitoring-grafana/) explains what they expose.

Leave the Jigasi REST API off (`JIGASI_ENABLE_REST` unset) unless you need it. A security researcher reported to 8x8 that an exposed, unauthenticated Jigasi REST API can be used to place outbound SIP calls (toll fraud); the report was closed as informative and a hardening pull request was not merged ([docker-jitsi-meet PR #2320](https://github.com/jitsi/docker-jitsi-meet/pull/2320)). If you do enable it, never publish its port.

## 5. Open only the ports Jitsi needs

| Port | Why |
|---|---|
| 443/tcp | The web app and its WebSocket connections |
| 80/tcp | Let's Encrypt certificates and the redirect to HTTPS |
| 10000/udp | Audio and video to the videobridge |
| Your TURN ports | Only if you run a [TURN server](/guides/jitsi-turn-server-coturn/) |

Block everything else in your firewall and in your cloud provider's security group. Prosody's XMPP ports are not published by docker-jitsi-meet and do not need to be reachable from outside.

## 6. Turn on Prosody rate limits

docker-jitsi-meet can limit how fast a single IP address may log in and join, which slows down room-flooding and password guessing. It is off by default. In `.env`:

```ini
PROSODY_ENABLE_RATE_LIMITS=1
```

That loads Prosody's `rate_limit` and `muc_rate_limit` modules with these defaults, each adjustable:

| Setting | Default | Meaning |
|---|---|---|
| `PROSODY_RATE_LIMIT_LOGIN_RATE` | `3` | Join or login events per second allowed per IP |
| `PROSODY_RATE_LIMIT_SESSION_RATE` | `200` | Bytes per second for an IP that went over the limit |
| `PROSODY_RATE_LIMIT_TIMEOUT` | `60` | Seconds until the limit for an IP is lifted |
| `PROSODY_RATE_LIMIT_ALLOW_RANGES` | `10.0.0.0/8` | Address ranges that are never limited |

Test with a few real users afterwards: if many people join from one office address at once, they share one IP.

## 7. Serve only HTTPS

Use a valid certificate ([Let's Encrypt setup](/guides/jitsi-lets-encrypt-ssl/)). Browsers block cameras, microphones and screen sharing on insecure pages anyway. docker-jitsi-meet sends a `Strict-Transport-Security` header by default (`ENABLE_HSTS=1`); leave it on.

## 8. Protect individual meetings

These are tools for organizers and moderators, on any server:

- **Lobby:** participants wait until a moderator admits them. The feature is available in docker-jitsi-meet by default (`ENABLE_LOBBY`); a moderator turns it on for a meeting.
- **Meeting password:** set by a moderator for one meeting. Jitsi notes that it is reset once the last person leaves, so set it again for the next meeting.
- **Room names:** use long, unusual names; short common names are easy to guess.
- **Participant limit:** `MAX_PARTICIPANTS` in `.env` caps how many people can join one room.
- **End-to-end encryption (E2EE):** media is always encrypted on the network with DTLS-SRTP, but the videobridge decrypts it in memory to route it. With E2EE turned on in a meeting, the bridge cannot read audio, video and screen sharing. According to Jitsi, E2EE does not cover chat or polls, and it only works when every participant uses a client that supports it.

More on what participants see: [login, moderator and password prompts](/guides/jitsi-login-moderator-password/).

## Verify

On the server:

```bash
docker compose ps --format '{{.Name}}\t{{.Ports}}'
```

Only the web ports and `10000/udp` should be bound to `0.0.0.0`; Jicofo's 8888 and the videobridge's 8080 should show `127.0.0.1`. Then, from another machine:

```bash
curl -sI https://meet.example.com | grep -i strict-transport-security
```

It should print a `Strict-Transport-Security` line with `max-age=63072000`. Finally, open a new room name in a private browser window: with `ENABLE_AUTH=1` you are asked to log in or wait for a moderator instead of starting the meeting.

## Common mistakes

- **Changing `.env` without recreating containers.** Run `docker compose up -d` after every change.
- **Reusing one password for every service** or committing `.env` to a repository.
- **Opening 8080 or 8888 "temporarily" for monitoring** and forgetting to close them.
- **Treating a meeting password as permanent.** It resets when the room empties.
- **Skipping upgrades for months.** Most items in the advisory table were fixed in ordinary releases.

## What we have not confirmed yet

- We took the defaults and settings from the `stable-11248` source; we have not yet run every check above on a test server, including the rate limit behaviour with many users behind one IP.
- Fixed versions marked "See advisory" are listed on the advisory page itself; we did not repeat them here.
- This checklist does not cover your operating system, cloud account, backups or monitoring for intrusion.

## Sources

- [NVD: CVE-2020-11878](https://nvd.nist.gov/vuln/detail/CVE-2020-11878), published 2020-04-17, CVSS 9.8, official vulnerability record
- [docker-jitsi-meet commit a015710 "security: don't provide default passwords"](https://github.com/jitsi/docker-jitsi-meet/commit/a015710), 2020-04-06, source code
- GitHub security advisories for [jitsi-meet](https://github.com/jitsi/jitsi-meet/security/advisories), [docker-jitsi-meet](https://github.com/jitsi/docker-jitsi-meet/security/advisories), [lib-jitsi-meet](https://github.com/jitsi/lib-jitsi-meet/security/advisories), [jitsi-videobridge](https://github.com/jitsi/jitsi-videobridge/security/advisories) and [jigasi](https://github.com/jitsi/jigasi/security/advisories), checked 2026-10-11, official advisories
- [NVD: CVE-2025-64754](https://nvd.nist.gov/vuln/detail/CVE-2025-64754), published 2025-11-13, official vulnerability record
- [docker-jitsi-meet at stable-11248](https://github.com/jitsi/docker-jitsi-meet/tree/stable-11248): `env.example`, `gen-passwords.sh`, `docker-compose.yml` (port mappings, environment), the Prosody template `prosody/rootfs/defaults/conf.d/jitsi-meet.cfg.lua` (rate limits, lobby, auth defaults) and `web/rootfs/defaults/ssl.conf` (HSTS), source code
- [docker-jitsi-meet PR #2320](https://github.com/jitsi/docker-jitsi-meet/pull/2320), Jigasi REST binding, closed unmerged, 2026-09
- [Jitsi: Security & Privacy](https://jitsi.org/security/) (DTLS-SRTP, E2EE scope, meeting passwords), official page, checked 2026-10-11

## Need a hand?

Want a second pair of eyes on your server? [Contact our engineers](/contact/?topic=jitsi-support) for a hardening review, or see our [support plans](/services/jitsi-support/).

## Frequently asked questions

### Who can create meetings on a new Jitsi server?

Anyone who can reach it. docker-jitsi-meet ships with ENABLE_AUTH=0, so every visitor can open a new room. Set ENABLE_AUTH=1, choose an AUTH_TYPE, and set ENABLE_GUESTS=1 if guests should still be able to join meetings that a signed-in user started.

### What was the Jitsi default password vulnerability?

CVE-2020-11878: docker-jitsi-meet releases before stable-4384-1 (April 2020) shipped default passwords such as passw0rd for internal service accounts, rated 9.8 critical. Current releases ship no default passwords and the services refuse to start without them; gen-passwords.sh writes strong random ones.

### Is Jitsi Meet end-to-end encrypted?

Media is always encrypted on the network with DTLS-SRTP, but the videobridge decrypts it in memory to route it. Optional end-to-end encryption covers audio, video and screen sharing, not chat or polls, and only works on clients that support it.

### Which ports should be open on a Jitsi server?

443/tcp for the web app, 80/tcp if Let's Encrypt needs it, and 10000/udp for media. Add your TURN server's ports if you run one. The Jicofo and videobridge REST ports are published only on 127.0.0.1 by default and should stay that way.

### How do I know about new Jitsi security issues?

Jitsi publishes advisories on GitHub for each project, such as jitsi-meet and docker-jitsi-meet. Watch the docker-jitsi-meet releases and those advisory pages, and upgrade with matching release files.


---

Jitsi Help is an independent service. It is not affiliated with, endorsed by or sponsored by 8x8, Inc. or the Jitsi project. Jitsi and Jitsi Meet are trademarks of 8x8, Inc., used here only to describe the software we host and support.