Improper Certificate Validation in freeswitch - CVE-2026-116789
Published: November 9, 2026
Vulnerability identifier: #VU162792
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116789
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated network attacker to decrypt and inject call media while impersonating the legitimate endpoint.
The vulnerability exists due to missing validation of peer certificates against the SDP fingerprint when FreeSWITCH acts as the DTLS server for DTLS-SRTP. An unauthenticated network attacker can obtain SRTP keys by completing a client handshake at the negotiated media port, requiring SDP connectivity-check credentials as well on ICE-enabled legs.
Affected software
freeswitch
How to mitigate CVE-2026-116789
Install security update from vendor's website.
freeswitch - update to 1.11.2