Summary
I will note, this is not exactly an bug, its more design/privacy gap/feature request/point of awareness.
To continue, anyone with livekit-cli/api access can create access tokens to voice calls that are not visible to fluxer app/web users.
While I would be obvious that generally speaking that livekit can do this, not being obvious to end-users is my issue here. As you can see in the screenshot below, I "fish-crested" is connected using the fluxer browser, but if I have used the livekit client, you can see my "guest-hacker" user and "fish-crested".
To confirm, I spoke as "guest-hacker" I was heard by "fish-crested".
To be clear, for private servers, this has valid uses. BUT the user should be aware that someone can hear potentially hear them.
I have not tried to see how E2EE goes, but as the is a function of livekit, if the key sharable, then its findable, then it could still potentially work.
An additional thing I have not yet tested is Direct Calling and how that is facilitated.
I did discuss with Security Team before making this post.
Steps to reproduce
with livekit-cli:
lk create-token --api-key abc --api-secret 123 --join --room guild_[guild-id]_channel_[channel-id] --identity guest-hacker --valid-for 1h
With give access token go to:
https://meet.livekit.io/?tab=custom
Livekit Server URL: wss://[fluxer-instance-fqdn]/livekit
Token: As generated.
Environment
As per operator guide with docker on ubuntu 26.04
Client:
Stable Web 2026.702.14514, Windows NT 10.0 (x64), Microsoft Edge 149.0.0.0, Locale en-US
Logs or screenshots
image
Checks
- ☑ I searched existing issues.
- ☑ I wrote this report in my own words, except for direct translation if needed.