[Self-Hosted] Hidden Callers in Voice Channels - Livekit

Summary

I will note, this is not exactly an bug, its more design/privacy gap/feature request/point of awareness.

To continue, anyone with livekit-cli/api access can create access tokens to voice calls that are not visible to fluxer app/web users.

While I would be obvious that generally speaking that livekit can do this, not being obvious to end-users is my issue here. As you can see in the screenshot below, I "fish-crested" is connected using the fluxer browser, but if I have used the livekit client, you can see my "guest-hacker" user and "fish-crested".

To confirm, I spoke as "guest-hacker" I was heard by "fish-crested".

To be clear, for private servers, this has valid uses. BUT the user should be aware that someone can hear potentially hear them.

I have not tried to see how E2EE goes, but as the is a function of livekit, if the key sharable, then its findable, then it could still potentially work.

An additional thing I have not yet tested is Direct Calling and how that is facilitated.

I did discuss with Security Team before making this post.

Steps to reproduce

with livekit-cli:

lk create-token   --api-key abc --api-secret 123   --join --room guild_[guild-id]_channel_[channel-id]   --identity guest-hacker   --valid-for 1h

With give access token go to: https://meet.livekit.io/?tab=custom Livekit Server URL: wss://[fluxer-instance-fqdn]/livekit Token: As generated.

Environment

As per operator guide with docker on ubuntu 26.04

Client: Stable Web 2026.702.14514, Windows NT 10.0 (x64), Microsoft Edge 149.0.0.0, Locale en-US

Logs or screenshots

Checks

• I searched existing issues.
• I wrote this report in my own words, except for direct translation if needed.