I worked as an intern with Mozilla last summer on helping to improve the issues around security in WebRTC specifically related to authentication and the possibility of MITM attacks. You can watch my intern presentation at [1] which goes through a very high level overview of the state of authentication in WebRTC and an example implementation of how WebRTC could be built into the browser to include authentication:

[1]: https://air.mozilla.org/intern-presentation-seys/

TLDR: E2E encryption is included, but authentication is currently non-existent, allowing for pretty easy MITM attacks if you have control of the relaying website.

Eric Rescorla does a good job of describing the security architecture and concerns around webrtc here:

http://tools.ietf.org/id/draft-ietf-rtcweb-security-arch-09....

and

http://tools.ietf.org/id/draft-ietf-rtcweb-security-06.txt

It's still a work in progress. Right now if you trust the service to connect you to the right person, everything works out. However, they aim to make things work even if you don't, and the jury is still out about whether or not they can make a UI that reflects this safely. Furthermore, there are some anonymity issues related to the use of RSA to secure the SRTP connections.

The identity provider portion involves trying to sandbox javascript in new and interesting ways. However, most of the pieces are fairly well understood, and the breaks will happen because identity providers mess up.

Some of the security is explained in an overview at Google IO. Here is a video: http://youtu.be/p2HzZkd2A40?t=22m18s

It's end-to-end, but you need a way to validate that you're talking to the peer that you think that you are - there's no certificate authority verifying client certs (in the normal case, I haven't explored traditional client-side certs for webrtc).