CVE-2026-49848 Overview
CVE-2026-49848 affects FreeSWITCH, an open-source software-defined telecom stack that runs on commodity hardware. The vulnerability resides in mod_verto, specifically in the check_auth userauth branch. Prior to version 1.11.1, the module wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes were append-only, and the connection did not close on a failed comparison. Attacker-controlled values declared during bad-password attempts persisted on the same WebSocket and carried into any subsequent successful login on that connection. The flaw is classified under CWE-287: Improper Authentication.
Critical Impact
Authenticated WebSocket clients can inject persistent userVariables into session state through failed authentication attempts, polluting the post-authentication context.
Affected Products
- FreeSWITCH versions prior to 1.11.1
- mod_verto WebSocket signaling module
- Deployments exposing the Verto endpoint to untrusted clients
Discovery Timeline
- 2026-06-09 - CVE-2026-49848 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-49848
Vulnerability Analysis
The mod_verto module handles WebSocket-based signaling for FreeSWITCH clients. When a client submits a login request, the check_auth routine in the userauth branch processes the JSON-RPC payload. The vulnerable code path applied userVariables from the request directly to the connection's persistent state before validating the password. Because the operation is append-only, the module accumulates these variables across multiple authentication attempts on the same WebSocket. The connection remains open after a failed password check, allowing the attacker to retry with different payloads. When a legitimate user eventually authenticates on that same WebSocket connection, the previously injected variables remain attached to their session.
Root Cause
The root cause is an ordering flaw in check_auth. State-mutating writes occur before the credential comparison, and no cleanup runs on failure. Combined with the decision to keep the WebSocket open after a failed password check, the module violates the principle that unauthenticated input must not influence authenticated session state. This is an Improper Authentication weakness ([CWE-287]).
Attack Vector
An attacker with network reach to the Verto WebSocket sends one or more login requests carrying crafted userVariables and an invalid password. Each attempt fails authentication, but the supplied variables persist on the connection. If a victim with valid credentials authenticates on the same WebSocket session, the attacker-controlled variables become part of the victim's session context. The vector requires network access and low-privilege interaction with the signaling endpoint.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-j38x-xm7f-9p2f for the maintainer's technical description.
Detection Methods for CVE-2026-49848
Indicators of Compromise
- Repeated login requests on a single Verto WebSocket containing populated userVariables followed by an authentication failure response.
- WebSocket sessions that transition from failed to successful authentication without a reconnect.
- Anomalous userVariables present on authenticated Verto sessions that were not set by the legitimate client.
Detection Strategies
- Inspect FreeSWITCH logs for mod_verto authentication failures originating from the same socket that later succeeds.
- Capture WebSocket traffic to the Verto port (default 8081 or 8082 for TLS) and flag login methods with non-empty userVariables fields.
- Correlate session identifiers across failed and successful logins to detect state carryover.
Monitoring Recommendations
- Forward mod_verto and sofia logs to a centralized analytics platform for query and retention.
- Alert on multiple consecutive authentication failures from a single source IP against the Verto endpoint.
- Track baseline userVariables keys per account and flag deviations.
How to Mitigate CVE-2026-49848
Immediate Actions Required
- Upgrade FreeSWITCH to version 1.11.1 or later, which contains the fix.
- Restrict network access to the Verto WebSocket endpoint to known client ranges using firewall rules.
- Audit existing Verto-enabled accounts for unexpected userVariables values.
Patch Information
The maintainers patched the issue in FreeSWITCH 1.11.1. The fix ensures userVariables are not written to connection state until after password verification succeeds, and failed authentication attempts terminate the WebSocket. Release notes and downloads are available at the FreeSWITCH GitHub Release v1.11.1. Refer to the GitHub Security Advisory GHSA-j38x-xm7f-9p2f for full advisory details.
Workarounds
- Disable mod_verto if WebSocket signaling is not required in your deployment.
- Place the Verto endpoint behind a reverse proxy or VPN that enforces client authentication before reaching FreeSWITCH.
- Enforce short WebSocket idle timeouts and reject connections after a small number of failed authentication attempts at the proxy layer.
# Configuration example: disable mod_verto in modules.conf.xml
# Comment out the load line, then reload FreeSWITCH
# <load module="mod_verto"/>
fs_cli -x "unload mod_verto"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
