Pexip Infinity
CVE-2025-66378
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Proxy Node over network
-
ExploitSend unauthorized RTMP control request
-
ImpactDisconnect active RTMP streams (availability loss)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Pexip Infinity deployment (version 38.0 or 38.1) that uses RTMP streaming where streams traverse a Proxy Node, and network reachability to that Proxy Node. Limiting factors: impact is confined to disconnecting RTMP streams (availability only - no confidentiality or integrity effect), only the specific versions 38.0/38.1 are affected (39.0 fixes it), and environments that do not use RTMP streaming through a Proxy Node are not exposed. Per CVSS PR:N, no authentication is required and no user interaction is needed. |
| Impact | This is a high-CVSS but comparatively narrow-impact issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remotely reachable, low-complexity, unauthenticated weakness, but the impact is strictly availability (C:N/I:N) - specifically the ability to disconnect RTMP streams traversing a Proxy Node, not code execution or data exposure. CWE-863 (Incorrect Authorization) aligns with the description's 'insufficient access control,' confirming this is an authorization/access-control defect rather than the 'Authentication Bypass' implied by the input tag. No EPSS score, CISA KEV entry, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; the 7.5 rating is driven by the easy network vector, not by demonstrated real-world abuse. Net priority is moderate: patch within normal cycles, prioritizing deployments that actually stream RTMP through Proxy Nodes, rather than treating it as an emergency. Note the limited reference set - only a generic Pexip security-bulletin index was supplied, so affected-version granularity beyond 38.0/38.1 could not be independently cross-checked. |
| Exploit ScenarioDerived | An attacker with network reachability to a Pexip Infinity Proxy Node sends crafted RTMP control traffic that the system fails to properly authorize, causing active RTMP streams (e.g., live event or meeting broadcasts) to be forcibly disconnected. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, enabling repeated denial of the streaming service. No public exploit code was provided in the intelligence available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated remote attackers can forcibly disconnect RTMP streams that traverse a Proxy Node in Pexip Infinity 38.0 and 38.1 because the RTMP implementation enforces insufficient access control, producing a denial-of-service condition with no confidentiality or integrity impact. The issue carries a high base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and per CVSS PR:N no authentication or user interaction is required. Pexip fixed the behavior in 39.0; no public exploit code has been identified at time of analysis, and real-world exposure is confined to deployments that actually stream RTMP through a Proxy Node.
RemediationAI
Upgrade Pexip Infinity 38.0 or 38.1 to 39.0, which is the vendor-released fix for this issue, and consult the Pexip security bulletins page at https://docs.pexip.com/admin/security_bulletins.htm for the official advisory, version matrix, and any deployment-specific upgrade ordering across Management and Proxy Nodes. If the upgrade cannot be performed immediately, the most effective compensating control is to remove the exposure path: disable RTMP streaming on deployments that do not require it (side effect: RTMP-based ingest/streaming features become unavailable), or, where RTMP must remain in use, restrict network reachability to the RTMP service on Proxy Nodes (commonly TCP 1935) using host firewalls, security groups, or upstream ACLs so only trusted streaming clients and sources can reach it (side effect: legitimate external RTMP sources must be explicitly allow-listed and any IP changes on those sources will break streaming until updated). Because authentication is not required by the vulnerable path, credential-based or session-based controls do not mitigate the issue; monitoring Proxy Node logs for unexpected RTMP stream teardown or repeated stream disconnects can help detect attempted abuse while remediation is pending.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a distributed videoconferencing/real-time media platform whose architecture separates signaling/management from media handling via Proxy Nodes, and RTMP is one of the ingest/streaming protocols those nodes can handle. The root cause is classed as CWE-863 (Incorrect Authorization): the RTMP path does not properly validate whether a requesting party is authorized to act on an in-progress RTMP stream, so an unauthenticated network actor reachable from the Proxy Node can issue a request that terminates streams they should not be able to affect. The CPE cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:* confirms the affected component is the Pexip Infinity product itself, with affected releases bounded to 38.0 and 38.1 (39.0 and later are outside the vulnerable range per the vendor). Because the CVSS impact vector is C:N/I:N/A:H, the observable effect is purely availability: stream teardown, not data disclosure or manipulation. The AV:N/AC:L/PR:N/UI:N vector means the attack is network-remote and low-complexity once a reachable Proxy Node handling RTMP is in scope.
Know when Pexip Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote low-complexity access to a Proxy Node with insufficient authorization (PR:N) lets an attacker disconnect streams, so A:H with C:N/I:N and unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.
Executive ViewAI
A vulnerability in Pexip Infinity versions 38.0 and 38.1 allows unauthenticated attackers to disrupt RTMP video streams that pass through Proxy Nodes, causing service outages for organizations relying on this streaming capability. Although no data is exposed or altered, the availability of critical video communications could be impacted, affecting remote collaboration and broadcasts. Leadership should prioritize remediation to maintain operational continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
More in Pexip Infinity
View allPexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-m
Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary c
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. Rated critical severity (CVS
Improper access control in the Pexip Infinity Secure Scheduler for Exchange service, when configured with deprecated Off
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Rated high severity (
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via On
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to t
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (so
Remote unauthenticated attackers can trigger a software abort (denial of service) in Pexip Infinity media implementation
Missing authentication for a critical function in Pexip Infinity's product-internal API, present in all releases before
Unauthenticated network attackers can crash Pexip Infinity 35.0 through 37.2 by sending crafted input to its signalling
Denial of service in Pexip Infinity 33.0 through 37.0 can be triggered by unauthenticated remote attackers who send craf
GitHub PoC
Exploit-DB