CVE-2026-41470
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.
Risk Assessment
An attacker can cause server crashes or disrupt active streaming sessions, leading to denial of service for legitimate users.
Recommendation
Upgrade LIVE555 to version 2026.04.22 or later, which fixes the issue.
Original NVD description (English source)
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.