# CVE-2025-66378: Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an…

Source: https://junglewise.ai/threats/cve-2025-66378-pexip-infinity-38-0-and-38-1-before-39-0-has-insufficient-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-25  
License: CC BY 4.0 with a link back

CVE-2025-66378 · Severity: medium · CVSS 5.9 · Published 2025-12-25

Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.

Technologies: [Pexip Infinity](https://junglewise.ai/threats/technologies/infinity). Vendors: [Pexip](https://junglewise.ai/threats/vendors/pexip).

## Quick answers

**Is CVE-2025-66378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66378 being exploited in the wild.

**How severe is CVE-2025-66378?** Medium severity, with a CVSS score of 5.9, published 25 December 2025.

**Which products and versions are affected?** Pexip Infinity. The advisory does not name versions.

**Is there a fix for CVE-2025-66378?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66378?** Check whether you run Pexip Infinity. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Pexip Infinity

## Related threats

- [Pexip Infinity remote code execution via improper input validation](https://junglewise.ai/threats/cve-2026-103110-pexip-infinity-before-38-2-plus-39-0-39-1-and-40-0-is-affected)
- [Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has…](https://junglewise.ai/threats/cve-2025-66443-pexip-infinity-35-0-through-38-1-before-39-0-in-non-default)
- [Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to…](https://junglewise.ai/threats/cve-2025-66379-pexip-infinity-before-39-0-has-improper-input-validation-in-the)
- [Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an…](https://junglewise.ai/threats/cve-2025-66377-pexip-infinity-before-39-0-has-missing-authentication-for-a)
- [Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service…](https://junglewise.ai/threats/cve-2025-59683-pexip-infinity-15-0-through-38-0-before-38-1-has-improper-access)