# CVE-2025-49088: Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest…

Source: https://junglewise.ai/threats/cve-2025-49088-pexip-infinity-32-0-through-37-1-before-37-2-in-certain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-25  
License: CC BY 4.0 with a link back

CVE-2025-49088 · Severity: medium · CVSS 5.9 · Published 2025-12-25

Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service.

Technologies: [Pexip Infinity](https://junglewise.ai/threats/technologies/infinity). Vendors: [Pexip](https://junglewise.ai/threats/vendors/pexip).

## Quick answers

**Is CVE-2025-49088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-49088 being exploited in the wild.

**How severe is CVE-2025-49088?** Medium severity, with a CVSS score of 5.9, published 25 December 2025.

**Which products and versions are affected?** Pexip Infinity. The advisory does not name versions.

**Is there a fix for CVE-2025-49088?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-49088?** Check whether you run Pexip Infinity. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Pexip Infinity

## Related threats

- [Pexip Infinity remote code execution via improper input validation](https://junglewise.ai/threats/cve-2026-103110-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected)
- [Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has…](https://junglewise.ai/threats/cve-2025-66443-pexip-infinity-35-0-through-38-1-before-39-0-in-non-default)
- [Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to…](https://junglewise.ai/threats/cve-2025-66379-pexip-infinity-before-39-0-has-improper-input-validation-in-the)
- [Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an…](https://junglewise.ai/threats/cve-2025-66378-pexip-infinity-38-0-and-38-1-before-39-0-has-insufficient-access)
- [Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an…](https://junglewise.ai/threats/cve-2025-66377-pexip-infinity-before-39-0-has-missing-authentication-for-a)