[jitsi-meet] Authentication Bypass when using JWT w/ public keys

Summary

A Prosody module allows the use of symmetrical algorithms to validate JWTs. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. There are no known incidents related to this vulnerability. Please refer to the published advisory: https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx We thank Nils Engelbertz for this finding!

In Jitsi Meet versions < 2.0.5963, it was possible to bypass JWT authentication when asymmetric JWT signatures were enabled. An adversary was able to forge valid JWTs by setting the JWT header's alg field to a symmetric algorithm such as HS256 and using the public key as the secret to compute the HMAC. In effect, knowledge of a configured public key was sufficient to start new conferences or enter protected conference rooms on affected instances.