Executive brief
A security flaw was found in ex_webrtc, a library used for real-time communication like video calls and data streaming. The software fails to properly verify the identity of the connecting party during certain types of connections. While difficult to exploit on its own, it could allow an attacker to intercept or modify private media and data if they also control the communication channel or if the other party has a similar security gap.
Technical details
The ex_webrtc library (Erlang/Elixir) contains an improper certificate validation vulnerability (CWE-295). When the library acts as a DTLS client (active role)—the default state when answering a browser's SDP offer—it skips the fingerprint check on the handshake-completion code path. This eliminates mutual authentication for SRTP media and SCTP data channels. While not independently exploitable against standards-compliant browsers over secure signaling, it enables a full Man-in-the-Middle (MITM) attack if the signaling channel is insecure (HTTP/WS), the signaling server is compromised, or the peer has a similar validation flaw. The issue is fixed in versions 0.15.1 and 0.16.1.
Affected products
- elixir-webrtc ex_webrtc < 0.15.1, 0.16.0
Timeline
- 2026-05-04: disclosed: Initial disclosure by reporter
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-14: patched: NVD publication and patch availability confirmed