DTLS-SRTP Vulnerability in FreeSWITCH Software by SignalWire

CVE-2026-116789

What is CVE-2026-116789?

FreeSWITCH, a Software Defined Telecom Stack, has a vulnerability in its DTLS implementation where the peer certificate is only validated in the client role and not in the server role. This allows an unauthenticated peer to connect to the negotiated media port, successfully completing the DTLS-SRTP handshake using an unrelated certificate. Consequently, this can lead to decryption of SRTP keys, enabling potential media injection and displacing legitimate users. The issue is prevalent in WebRTC and SIP DTLS-SRTP legs when peer role selection is active. As a remedial measure, version 1.11.2 has been released, enforcing certificate verification during the handshake process.

References