CVE-2026-49843: FreeSWITCH Auth Bypass Vulnerability

CVE-2026-49843 Overview

CVE-2026-49843 is an authentication flaw [CWE-287] in FreeSWITCH, the open-source software-defined telecom stack used to replace proprietary PBX and switch hardware. The vulnerability resides in mod_verto, which implements the JSON-RPC signaling protocol for WebRTC clients. Prior to version 1.11.1, the module bound an incoming connection to the client-supplied sessid on the first frame, before the authentication gate executed. An unauthenticated network attacker who knows or guesses a victim's session UUID can evict the legitimate client from the global session hash. FreeSWITCH has patched the issue in version 1.11.1.

Critical Impact
A remote, unauthenticated attacker can forcibly disconnect any active Verto session and detach its in-progress calls by replaying the target session UUID.

Affected Products

FreeSWITCH versions prior to 1.11.1
Deployments using mod_verto for WebRTC/JSON-RPC signaling
Any FreeSWITCH instance exposing Verto endpoints to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-49843 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49843

Vulnerability Analysis

mod_verto exposes a JSON-RPC interface used by Verto WebRTC clients to register, place calls, and exchange media signaling. Each client connection is identified by a sessid value, typically a UUID generated by the client. FreeSWITCH stores active sessions in a global session hash keyed by this identifier.

The vulnerability stems from improper sequencing of session registration and authentication. When the server receives the first frame on a new socket, it inserts the connection into the global session hash using the attacker-supplied sessid before validating credentials. If the hash slot is already occupied by an authenticated client, the existing entry is displaced.

Displacement is not silent. FreeSWITCH sends the evicted connection a verto.punt message, detaches any active calls associated with it, and closes the underlying socket. The attacker does not need to complete authentication or sustain the connection. The damage occurs on the first frame.

Root Cause

The root cause is a logic ordering defect in the Verto session handler. Authentication is treated as a post-binding step rather than a precondition for session registration. The handler trusts the client-supplied sessid to determine hash placement without verifying the caller has any right to that identifier.

Attack Vector

Exploitation requires network reachability to the Verto endpoint (commonly TCP 8081 or 8082 for WSS) and knowledge of a target sessid. Session UUIDs can be obtained through traffic interception on unencrypted channels, log exposure, client-side disclosure in browser storage, or by harvesting identifiers from related infrastructure. The attacker opens a WebSocket connection and submits a JSON-RPC frame carrying the victim's sessid, which triggers the eviction path during binding.

The vulnerability does not enable code execution or credential theft. The integrity and confidentiality impact is none. The available impact is limited to disrupting active sessions, dropping in-progress calls, and forcing client reconnections.

Detection Methods for CVE-2026-49843

Indicators of Compromise

Unexpected verto.punt events delivered to legitimate clients followed by immediate socket closure
Repeated short-lived Verto connections from unfamiliar source IPs that present known sessid values
Spikes in client-side reconnect loops or call-drop events without corresponding network faults
FreeSWITCH logs showing the same sessid bound from multiple source addresses within seconds

Detection Strategies

Parse FreeSWITCH logs for verto.punt emissions correlated with new inbound connections rather than client-initiated logouts
Alert on duplicate sessid registrations originating from distinct source IP addresses or User-Agent values
Track the ratio of pre-authentication socket closures to successful Verto logins on each FreeSWITCH host

Monitoring Recommendations

Forward mod_verto and freeswitch.log events to a centralized SIEM and retain them for correlation
Monitor WebSocket connection churn on ports 8081 and 8082 for anomalous burst patterns
Baseline normal Verto session lifetimes and alert on populations of sessions terminated within milliseconds of binding

How to Mitigate CVE-2026-49843

Immediate Actions Required

Upgrade FreeSWITCH to version 1.11.1 or later, where session binding occurs only after authentication succeeds
Restrict network access to Verto listener ports so that only trusted client networks or upstream proxies can reach them
Audit existing FreeSWITCH deployments for exposed mod_verto interfaces on the public internet

Patch Information

The fix is included in the FreeSWITCH v1.11.1 release. Refer to the GitHub Security Advisory GHSA-9457-fxr9-x78m for full vendor guidance. The patch reorders the JSON-RPC handler so that authentication completes before the connection is inserted into the global session hash, preventing collision-driven eviction of authenticated clients.

Workarounds

Place FreeSWITCH Verto endpoints behind a reverse proxy or WAF that enforces client certificate or token authentication at the TLS layer
Use firewall ACLs to limit Verto access to known client subnets until upgrade is feasible
Disable mod_verto in modules.conf.xml if Verto signaling is not required by the deployment

bash

# Disable mod_verto until patching is complete
# Edit conf/autoload_configs/modules.conf.xml and comment out:
# <load module="mod_verto"/>
fs_cli -x 'unload mod_verto'