October was busy: 21 FreeSWITCH advisories, a Pion DTLS flaw that undermined WebRTC peer authentication, and BigBlueButton bugs leading to command execution and invisible meeting audio access. We also published an Enswitch password-reset bypass that had been abused before disclosure, alongside browser security fixes and a broad selection of shorter security updates.
In this edition, we cover:
- Enswitch: a password-reset authentication bypass that was abused before disclosure
- FreeSWITCH: 21 advisories covering ICE and DTLS authentication, two command-execution paths, and a broad set of parser bugs
- Pion DTLS: peer impersonation using a genuine certificate without its private key, plus five other advisories
- BigBlueButton: FreeSWITCH command injection and invisible access to meeting audio
- Browser WebRTC fixes: updates across Chrome, Firefox and Safari
- Short news: our OpenSSL DTLS product-path review, Janus, pjproject, mediasoup, OpenSIPS and more
The RTCSec newsletter is a free periodic newsletter bringing you commentary and news around VoIP and WebRTC security. We cover both defensive and offensive security as they relate to Real-time Communications.
What is RTC security anyway? Real-time communications security determines if you can safely communicate in real time - whether it be with other humans or machines.
You may sign up to receive the RTCSec newsletter here. If you like what we’re doing, you’re most welcome to:
- Forward it to those who may find this newsletter particularly fruitful.
- Let us know if there are any RTC security news items we should cover.
To view past issues, please visit our website at https://www.enablesecurity.com/newsletter/.
Our news
Enswitch password reset bypass was abused before disclosure
We published ES2026-06 about a password reset authentication bypass in Enswitch, tracked as CVE-2026-107640 (CVSS v4.0 9.3, Critical).
The password reset API compared the supplied reset key with the value stored for the account. If no reset was pending, both values could end up empty and compare equal. Anyone who knew a valid username could then set a new password without receiving the reset email. The same endpoint could also be used to enumerate usernames.
We confirmed the issue on Enswitch 4.2, while Integrics told us that supported versions from 3.13 to 4.4 needed the fix. They supplied fixes for testing on the day we reported it and released them to customers three days later. Nice turnaround!
We are aware of the vulnerability being abused in the wild before public disclosure. If you run Enswitch, apply Subversion revision 21680 or later for supported 3.13 through 4.3 branches, or Git commit c2c981578 or later for 4.4. The advisory has the full details. We also published a blog post explaining how a simple empty-value comparison turned a password reset into an account takeover.
What’s happening?
FreeSWITCH publishes 21 security advisories
SignalWire published 21 FreeSWITCH security advisories on 26 and 28 October, plus two upstream Sofia-SIP advisories and one SpanDSP advisory. A separate third-party Sofia-SIP CVE record appeared earlier in October. Four FreeSWITCH issues stand out: broken ICE authentication, missing DTLS fingerprint verification, the api-chat RCE first covered in August, and SIP REFER command execution.
Two advisories affect WebRTC authentication:
ICE checks were not authenticated. FreeSWITCH generated STUN
MESSAGE-INTEGRITYvalues but did not verify them on received checks (CVE-2026-116790, Critical). Anyone reaching an ICE call’s UDP media port could forge a Binding Request, nominate their own address, and redirect RTP and DTLS. FreeSWITCH 1.11.2 adds opt-in verification throughice_verify_message_integrity=true; upgrading without enabling it leaves receive-side behavior unchanged.The DTLS certificate was not always checked against the SDP fingerprint. In the server role, FreeSWITCH accepted any certificate that completed the handshake (CVE-2026-116789, High). An attacker who reaches the media port and replaces the legitimate DTLS client receives the SRTP keys and can decrypt or inject media. On an ICE-enabled leg, this flaw alone normally also requires ICE credentials or a position on the media path. Browsers usually put FreeSWITCH into this server role. The new check is opt-in through
rtp_dtls_client_cert_verify_mode=fingerprint; its defaultnonemode preserves the old behavior.
The flaws appear chainable: one redirects the media handshake without valid ICE credentials, while the other accepts the redirected peer’s certificate. We have not validated the complete attack end to end. See also this month’s Pion DTLS peer-impersonation advisory.
Another advisory covers the api-chat issue reported in August and updated in September. CVE-2026-116779, rated Critical, lets a SIP MESSAGE recipient beginning with api+ invoke unrestricted API commands, including OS commands. On vulnerable versions through 1.11.2, stock conf/vanilla includes a special directory user named default with no password. Unless allow-empty-password is set to false, an attacker can authenticate as that user without knowing any credentials; downstream packaging may differ. Ordinary SIP accounts can also reach the path. We confirmed exploitation on one compromised FusionPBX server. FreeSWITCH 1.11.3 blocks it by default; leave enable-chat-api-proto disabled.
A separate mod_sofia path lets a registered SIP user controlling one leg of a bridged call send a crafted REFER. In affected versions, a comma in attacker-controlled Refer-To parameters is treated as a separator for channel variables on a new outbound leg (CVE-2026-116786, High). The advisory demonstrates OS command execution by injecting execute_on_originate with the normally enabled system application. We flagged the fix during our August investigation but did not reproduce it before publication. The attack requires a registered account and bridged call, but no administrative or Event Socket access, custom dialplan, or non-default module. FreeSWITCH 1.11.2 fixes it.
The other 17 advisories cover memory-safety and denial-of-service bugs in SDP, presence/BLF, MSRP, RTCP, T.38, Event Socket, XML, SIP PUBLISH, mod_xml_rpc, mod_rtmp and core variable expansion. Exposure varies: MSRP, mod_xml_rpc WebSockets and mod_rtmp are disabled by default; Event Socket is local-only unless its ACL is expanded; and the mod_spandsp issue requires an established T.38 session. See the FreeSWITCH advisory list for the individual issues.
The upstream Sofia-SIP advisories cover a SIP-over-WebSocket heap overflow (CVE-2026-116791) and DNS compression-pointer loop (CVE-2026-116792), fixed in 1.13.18. A separate multipart/MIME out-of-bounds read (CVE-2026-110658) is fixed in 1.13.19. The SpanDSP T.30 fax issue (CVE-2026-116793) is fixed in 3.1.0 and does not affect T.38 gateway mode.
Upgrade to FreeSWITCH 1.11.3 and leave enable-chat-api-proto disabled. Version 1.11.3 alone does not resolve the two WebRTC authentication flaws: enable ice_verify_message_integrity=true and rtp_dtls_client_cert_verify_mode=fingerprint on affected WebRTC paths, then test ICE and DTLS negotiation in your deployment. FreeSWITCH 1.11.3 only requires Sofia-SIP 1.13.18, so upgrading FreeSWITCH does not guarantee the MIME parser fix. Check the linked Sofia-SIP version and update it to 1.13.19 or later. Direct SpanDSP users should use current release 3.1.1, although 3.1.0 is the first patched version. Review the advisories for the modules, listeners and media features your deployment exposes.
Browsers patch another batch of WebRTC vulnerabilities
October’s browser updates fixed another large batch of WebRTC bugs. Google shipped nine explicitly identified WebRTC, MediaStream and GetUserMedia fixes across Chrome 154, 155 and 156. The standout is a Critical WebRTC memory-corruption flaw in Chrome 156 (CVE-2026-113303), reported by OpenAI Codex Security. Google’s release post provides no further technical details and does not say that the flaw was exploited in the wild.
Mozilla fixed two Low-severity WebRTC bugs in Firefox 158 and six in Firefox 159. The Firefox 159 set comprises four High-severity issues (three use-after-free flaws and one bounds bug) and two Moderate issues, including a cryptographic issue in WebRTC networking. Safari 27.2 for macOS Sequoia and Tahoe fixed two WebRTC memory-safety bugs that Apple says could cause an unexpected process crash.
The advisories do not describe a single cross-browser WebRTC design flaw. They cover a mixture of memory-safety, bounds-checking, authorization and cryptographic issues. Keep browsers current, and update Electron or other Chromium-based applications when their vendors ship builds containing the corresponding Chromium fixes.
Pion DTLS peer impersonation undermines WebRTC fingerprint authentication
Pion published six DTLS security advisories on 16 October, including a critical flaw that lets an attacker impersonate a WebRTC peer using that peer’s genuine certificate, but without its private key. All six were found by Anthropic’s OSS Scanner and fixed by Jo Turk.
The most consequential one for WebRTC is GHSA-7c2r-jhm9-43vf (vendor CVSS v3.1 score 9.1). For ECDSA certificates, an attacker could choose an invalid signature and hash combination that made Pion verify an empty digest instead of the handshake transcript. The attacker could then create a value that passed this check using only the certificate’s public key, without knowing its private key. Pion therefore treated the attacker as the certificate holder even though the signature proved neither private-key possession nor agreement to this handshake.
We reproduced this at the verification-function level: v3.1.12 accepted the same public-key-derived signature for two messages, while v3.1.13 rejected it. A practical attack requires redirecting or intercepting the DTLS handshake and obtaining the genuine peer certificate. Reusing that certificate preserves the SDP fingerprint while bypassing proof of private-key ownership. We did not test a packet-level handshake, Pion WebRTC, SRTP establishment, media injection or a transparent relay. See also the FreeSWITCH DTLS flaw.
The other advisories cover an oversized RSA key CPU denial of service, repeated client-certificate processing, an unbounded handshake cache, and two SessionStore authentication bypasses (one, two). The session flaws require specific resumption configurations and, Pion says, do not affect WebRTC users.
Pion DTLS v3.1.13 fixes the impersonation and denial-of-service issues; v3.1.14 adds the session-resumption fixes. No patched v1 or v2 release is listed. For WebRTC users, v4.2.24 is the minimum with the four relevant fixes, while v4.2.25 and v4.2.26 contain all six. WebRTC v3.3.6 still uses unpatched DTLS v2.2.12, so upgrading requires moving to v4. Prefer v4.2.26, the latest release at publication time, or newer.
BigBlueButton fixes FreeSWITCH command injection and invisible meeting audio access
BigBlueButton published nine security advisories on 1 October. Two stand out for us: unauthenticated command execution through exposed FreeSWITCH SIP ports, and a way to enter a meeting’s audio conference without appearing in the participant list. Two September advisories complete the picture, as they exposed related failures at the meeting boundary.
The audio bypass is in the bbb-webrtc-sfu and FreeSWITCH path, which BigBlueButton 4 retains as an alternative to its default LiveKit bridge. The command injection applies regardless of the media bridge. Both attacks require FreeSWITCH SIP ports to be reachable from an untrusted network.
FreeSWITCH command injection. A remote unauthenticated attacker could add arguments to the dialplan’s
destination_number, select FreeSWITCH’s inline dialplan and run applications, including OS commands, under the service account (GHSA-f6gw-hpfv-5gxg, Critical). The 3.0 fix and 4.0 fix restrict the value to 5-11 digits.Invisible access to meeting audio. An unauthenticated caller could enter an active meeting’s audio conference without being admitted (GHSA-49qg-pcv3-r2g6, High). The caller could listen and inject audio while remaining absent from the participant list, so moderators could neither mute nor eject them. The dialplan authorized SFU calls from a spoofable SIP
User-Agenton plain SIP, while FreeSWITCH event handling ignored every caller name beginning withGLOBAL_AUDIO_rather than only the meeting’s exact bridge name.
Two September advisories exposed the same meeting boundary. One let an authenticated attendee join another meeting’s audio bridge (GHSA-g92v-3w29-55rh, High). Another allowed /api/join parameters to evade checksum validation, bypass the guest lobby and impersonate a moderator (GHSA-q8vx-4cgc-7w4w, Critical). They were fixed in 3.0.37 and 3.0.29 respectively.
The common problem is misplaced trust: routing values became syntax, and SFU or meeting identities were treated as authorization. BigBlueButton fixed the October issues in 3.0.38 and 4.0.0-rc.4. Upgrade, and restrict FreeSWITCH ports 5060, 5066 and 7443 to loopback or trusted SFU and SIP gateway systems. A firewall closes the October paths but does not replace the application fixes.
Short news
OpenSSL DTLS retransmission can disclose heap memory or crash applications (CVE-2026-84782)
OpenSSL fixed a High-severity DTLS out-of-bounds read (CVE-2026-84782, CISA CVSS v3.1 8.2). If a fragmented handshake write remains suspended with WANT_WRITE while a retransmission fires, OpenSSL may send unrelated heap bytes as plaintext handshake data or crash the process.
Our review found no confirmed trigger in the default deployments of Asterisk, FreeSWITCH, coturn, OvenMediaEngine, pjproject, rtpengine, RTPProxy, GStreamer, Kurento, mediasoup, MiroTalk, SRS or libdatachannel: none combined a transport-backed parked DTLS write with independent retransmission. Janus uses OpenSSL, but its standard P-256 certificate and 1200-byte MTU did not fragment a handshake message, another required condition. Jitsi Videobridge and the reviewed Pion SFUs do not use OpenSSL for DTLS.
No reviewed default path was confirmed affected, but OpenSSL should still be updated. Fixed versions are 4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23, 1.1.1zj and 1.0.2zs; the fixes for 3.0, 1.1.1 and 1.0.2 require premium support.
Kamailio 6.1.5 fixes ISUP parser overflows (CVE-2026-108822)
Kamailio released 6.1.5 with fixes for buffer overflows and out-of-bounds reads in the sipt module’s ISUP number parsers (CVE-2026-108822). A remote peer can reach the vulnerable code where sipt is loaded and routing logic evaluates affected $sipt(...) fields on attacker-controlled SIP-T/ISUP content.
Versions 6.0.0 through 6.0.7 and 6.1.0 through 6.1.4 are affected; the patch is included in 6.0.8 and 6.1.5. The CVE record incorrectly lists 6.1.4 as fixed, but that tag does not contain the patch. The update requires no schema or configuration changes.
Janus 1.4.3 fixes Record&Play and SIP plugin crashes
Janus 1.4.3 and 0.16.3 fix two High-severity denial-of-service flaws. An ordinary Record&Play API client can supply an oversized video fmtp value in its SDP, which Janus stores in an .mjr header. Playing the recording or scanning it during startup can overflow a fixed buffer; because the file remains on disk, Janus can enter a persistent crash loop.
The SIP plugin flaw requires API access and leaves a stale pointer when a master becomes a helper. A separate Medium Record&Play path traversal (CVE-2026-110717) affects releases through 1.4.3. The CVE was published without first notifying the Janus developers. Thanks to Lorenzo Miniero for the quick fix, which will ship in the next releases.
pjproject publishes 19 October security advisories
pjproject published 19 security advisories in October, including four rated High. The High-severity RTC issues cover non-SIP route URIs, Opus packet-loss concealment, G.729 and AMR encoding with long remote packet times, and repeated RED formats in SDP offers.
The RED flaw is reachable with one unauthenticated INVITE under default PJSUA/PJSUA2 text-media settings; the G.729 and AMR issue requires those optional codecs. Other advisories cover video, jitter-buffer, MESSAGE, ICE, TURN and lifetime bugs. The affected ranges include pjproject 2.17. Fixes are on master, but no patched release was available as of 29 October.
ACR Phone deeplink enables one-tap carrier call forwarding
Karan Saini demonstrated one-click MMI execution through ACR Phone / Cube ACR (com.nll.cb). When the app holds CALL_PHONE and is selected as the default dialer, a malicious web link can invoke its browsable CALL_BUTTON handler and register unconditional carrier call forwarding without a confirmation prompt.
The forwarding persists at the carrier and can redirect calls, voice-delivered authentication codes and banking callbacks. The developer said a fix was committed for the next release, but the disclosure does not identify affected or fixed versions.
asterisk-conf-lint checks Asterisk configurations for security mistakes
asterisk-conf-lint v0.1.0 is a static security linter with 25 checks for common Asterisk configuration mistakes. It detects weak AMI, ARI and SIP credentials, unauthenticated endpoints, broad IP trust, dangerous AMI permissions, #exec, dialplan shell injection, toll-fraud patterns, cleartext HTTP exposure and disabled Strict RTP.
Note that we have not yet tested this tool, but it should be of interest to the RTCSec news audience.
sipgo ACK handling allows unauthenticated process crashes (CVE-2026-110783)
The Go SIP library sipgo has a published unauthenticated denial-of-service flaw (CVE-2026-110783) affecting versions 0.22.1 through 1.4.3; version 1.5.0 fixes it. After a non-2xx response leaves an INVITE server transaction completed, a matching ACK without a Call-ID can reach ackSend() and trigger a nil-pointer panic when the application is not consuming the ACK channel, crashing the process.
Signal fixes RingRTC queue saturation that can prevent calls from hanging up (CVE-2026-113380)
Signal fixed a RingRTC call-teardown flaw in version 2.72.0. The CVE record rates it Critical (CVE-2026-113380, CVSS 4.0 9.3). A malicious peer can fill the finite-state machine queue so that a local hangup does not tear down the call, potentially leaving audio and possibly video active after the user believes the call has ended.
WatchGuard fixes a pre-authentication SIP proxy RCE
WatchGuard fixed a stack overflow in Fireware’s SIP proxy (CVE-2026-93857, CVSS 4.0 9.2). An unauthenticated remote attacker can execute code when a firewall policy uses the SIP proxy. The patches are Fireware 2026.4, 12.12.4 and 12.5.22 for T15/T35.
mediasoup publishes three remote worker-crash advisories
mediasoup published three advisories for inputs that abort an entire worker and disconnect every session hosted on it. The High-severity case, CVSS 8.6, needs only a 24-byte RTP packet containing a zero-length two-byte header extension (GHSA-6p5q-wg3x-j8x5). A Medium-severity RTP flaw, CVSS 5.9, requires an oversized packet that exceeds the 65,536-byte backing buffer while mediasoup rewrites extensions (GHSA-j93j-ccgc-x8q5).
The Medium-severity SCTP issue, CVSS 6.8, uses a large INIT-ACK State Cookie to overflow the fixed COOKIE-ECHO packet or leave no room for a bundled SACK (GHSA-prx9-f2m2-6236). The RTP flaws affect npm mediasoup through 3.32.0 and Rust mediasoup through 0.33.0. The SCTP issue affects npm 3.20.0 through 3.32.0 and Rust 0.22.0 through 0.33.0. None listed a patched release as of 29 October.
OpenSIPS 4.0.3 and 3.6.10 add parser and memory-safety fixes
OpenSIPS 3.6.10 and 4.0.3 add parser bounds, WebSocket, RTP, B2B, SIPREC, HEP and other memory-safety fixes. Changes since the previous maintenance releases include bounded SIP header and URI parsing, bounds checks for rebuilt HEP packets and typed reads, RTP relay ownership fixes and bounded socket formatting.
The cumulative changelogs also list the unsupported-ppt STIR/SHAKEN double-free, but that fix already shipped in 3.6.9 and 4.0.2 and is not new to these October releases.
Thanks to Vulners and other third parties for providing vulnerability source material.
This newsletter was prepared by Sandro Gauci and the Enable Security team for RTCSec newsletter subscribers. If you have someone in mind who would benefit from our content, please share.
To subscribe: here