Authentication Bypass by Spoofing in freeswitch - CVE-2026-116790
Published: November 9, 2026
Vulnerability identifier: #VU162791
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116790
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to redirect media and disrupt active ICE-enabled FreeSWITCH calls.
The vulnerability exists due to missing STUN MESSAGE-INTEGRITY verification in FreeSWITCH's inbound ICE handling when connectivity checks reach an active call's UDP media port. An unauthenticated remote attacker can send forged Binding Requests to that reachable port without ICE credentials, redirecting media to an attacker-controlled address and enabling eavesdropping and injection when media encryption is not negotiated.
Affected software
freeswitch
How to mitigate CVE-2026-116790
Install security update from vendor's website.
freeswitch - update to 1.11.2