What is the CVSS score of CVE-2026-49843?

CVE-2026-49843 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-49843?

Yes, a patch is available for CVE-2026-49843. Update the affected software to the latest version immediately.

FreeSWITCH CVE-2026-49843

EUVD-2026-35492 MEDIUM

Improper Authentication (CWE-287)

2026-06-09 GitHub_M

Authentication Bypass Freeswitch

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 09, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 09, 2026 - 16:51 vuln.today

Analysis Generated

Jun 09, 2026 - 16:51 vuln.today

DescriptionGitHub Advisory

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot - sending it a verto.punt, detaching its calls, and closing its socket. An unauthenticated network attacker who knows a target session UUID could therefore evict the legitimate client. This issue has been patched in version 1.11.1.

AnalysisAI

Session eviction via unauthenticated sessid collision in FreeSWITCH mod_verto (all versions prior to 1.11.1) allows a remote unauthenticated attacker who knows a target client's session UUID to forcibly disconnect that client - terminating active calls and closing their WebSocket connection - by racing a crafted JSON-RPC first-frame before the authentication gate. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms full network reachability with no credentials required; the sole prerequisite is knowledge of the victim's session UUID. No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog.

Technical ContextAI

FreeSWITCH is a software-defined telecom stack developed by SignalWire (CPE: cpe:2.3:a:signalwire:freeswitch:*:*:*:*:*:*:*:*). The affected component is mod_verto, its WebSocket-based JSON-RPC interface used for real-time browser-to-phone and SIP bridging. The flaw is classified as CWE-287 (Improper Authentication): on the very first JSON-RPC frame received over a new WebSocket connection, the handler extracts the client-supplied 'sessid' field and immediately inserts the connection into the global session hash table - binding the socket identity before any password check occurs. When an attacker supplies a sessid matching an already-resident legitimate session, the hash insert triggers a collision-resolution path that drops the prior occupant: the evicted client receives a 'verto.punt' signaling event, its in-progress calls are detached, and its TCP socket is closed. The release notes for v1.11.1 confirm the fix as 'Gate sessid bind on auth, block cross-identity eviction,' alongside the related 'Defer userauth state writes until after password gate,' indicating the authentication gate was moved earlier in the connection lifecycle.

RemediationAI

Upgrade to FreeSWITCH v1.11.1, confirmed as the vendor-released patch at https://github.com/signalwire/freeswitch/releases/tag/v1.11.1. The v1.11.1 release notes explicitly list 'Gate sessid bind on auth, block cross-identity eviction' as the targeted security fix and characterize the release as containing 'critical security fixes'; SignalWire strongly encourages immediate upgrade. If immediate patching is not feasible, restrict access to the mod_verto WebSocket port (typically TCP 8081/8082) to trusted IP ranges via firewall or reverse-proxy ACLs - this prevents unauthenticated external actors from reaching the vulnerable handler, though it does not eliminate risk from trusted-network attackers who may already possess session UUIDs. Note that completely disabling mod_verto is a more aggressive workaround only viable for deployments that do not depend on the Verto protocol for browser or WebRTC clients; doing so would terminate those call paths. The v1.11.1 release also patches a heap overflow in the mod_verto HTTP POST body reader and a use-after-free in the core session thread pool, making the upgrade advisable on multiple independent security grounds.