CVE-2026-49848
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Vulnerability in FreeSWITCH before version 1.11.1 in mod_verto's check_auth userauth branch writes request-supplied userVariables into the connection state before password comparison. Writes are append-only and the connection is not closed on failed compare, so values from bad-password attempts persist on the same WebSocket and carry into a subsequent successful login.
Risk Assessment
An attacker can leverage persisted user variables from failed login attempts to escalate privileges or gain unauthorized access after a successful login.
Recommendation
Update FreeSWITCH to version 1.11.1 or later.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-9754Medium
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- CVE-2026-49847High
Stack overflow vulnerability in FreeSWITCH before version 1.11.1. A single unauthenticated WebSocket frame with a deeply nested JSON document crashes the FreeSWITCH process, terminating all calls and sessions on the host.
- CVE-2026-49843Medium
FreeSWITCH before version 1.11.1 has a vulnerability in mod_verto. The JSON-RPC handler binds the connection to the client-supplied sessid before the authentication gate. An unauthenticated attacker who knows a target session UUID can evict the legitimate client by sending it a verto.punt and closing its socket.
- CVE-2026-49842High
Vulnerability in FreeSWITCH before version 1.11.1. The mod_verto's WebSocket frame loop intercepts a #-prefixed speed-test protocol (#SPU / #SPB / #SPE) before any authentication check. The declared payload size in #SPU was parsed with atoi() and only rejected non-positive values, so an unauthenticated peer could request up to INT_MAX bytes. The server then wrote roughly size * 10 bytes back during the download phase, on the order of 20 GB per request, yielding strong outbound bandwidth amplification from a short request.
- CVE-2026-49475High
FreeSWITCH prior to version 1.11.0 has a flaw in STUN packet handling where a declared attribute length shorter than the structure causes out-of-bounds memory access on the media buffer.
- CVE-2026-49472Medium
FreeSWITCH prior to version 1.11.0 includes a vulnerable function PREFIX(prologTok)() in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.
- CVE-2026-45771High
FreeSWITCH prior to version 1.11.0 has a vulnerability in its bundled XML parser that expands nested <!ENTITY> declarations without depth or count limits, enabling a "billion laughs" attack. An unauthenticated network attacker can send a single SIP PUBLISH request with a PIDF body that, before any digest check, causes unbounded CPU and memory consumption.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes are append-only and the connection is not closed on a failed compare, so values declared on bad-password attempts persisted on the same WebSocket and carried into a subsequent successful login on that connection. This issue has been patched in version 1.11.1.