# CVE-2026-49843: FreeSWITCH improper authentication in mod_verto allows session eviction

Source: https://junglewise.ai/threats/cve-2026-49843-freeswitch-improper-authentication-in-mod-verto-allows-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-49843 · Severity: medium · CVSS 5.3 · Published 2026-06-09

FreeSWITCH is a software-based telecommunications platform used to handle voice and video calls. A security flaw in its communication module allows an unauthenticated attacker to forcibly disconnect legitimate users and drop their active calls if the attacker knows the user's session ID. While this does not allow the attacker to steal data or take over accounts, it can be used to disrupt telecommunications services and cause targeted outages.

Technologies: [SignalWire FreeSWITCH](https://junglewise.ai/threats/technologies/freeswitch). Vendors: [SignalWire](https://junglewise.ai/threats/vendors/signalwire).

## Quick answers

**Is CVE-2026-49843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49843 being exploited in the wild.

**How severe is CVE-2026-49843?** Medium severity, with a CVSS score of 5.3, published 9 June 2026.

**Which products and versions are affected?** SignalWire FreeSWITCH < 1.11.1.

**Is there a fix for CVE-2026-49843?** A patch was published on 2026-05-26: Version 1.11.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49843 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49843?** Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in FreeSWITCH's mod_verto module where the JSON-RPC handler binds a connection to a client-supplied 'sessid' on the very first frame, prior to the authentication gate. This binding process inserts the connection into a global session hash; if an attacker provides a 'sessid' that is already in use, the system triggers a key collision and 'punts' the original occupant. This results in the legitimate client's calls being detached and their WebSocket connection being closed. While the attacker cannot bypass authentication to perform further actions, they can effectively perform a targeted Denial of Service (DoS) if they obtain a valid session UUID through side channels. The issue is resolved in version 1.11.1 by moving the session binding logic until after successful authentication.

## Affected products

- SignalWire FreeSWITCH < 1.11.1

## Timeline

- 2026-05-26: patched: Version 1.11.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD

## References

- [https://github.com/signalwire/freeswitch/releases/tag/v1.11.1](https://github.com/signalwire/freeswitch/releases/tag/v1.11.1)
- [https://github.com/signalwire/freeswitch/security/advisories/GHSA-9457-fxr9-x78m](https://github.com/signalwire/freeswitch/security/advisories/GHSA-9457-fxr9-x78m)

## Related threats

- [FreeSWITCH ICE integrity validation bypass](https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH DTLS fingerprint validation bypass in server role](https://junglewise.ai/threats/cve-2026-116789-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH integer underflow in XML decode](https://junglewise.ai/threats/cve-2026-116788-freeswitch-is-an-open-source-software-telecommunications)
- [FreeSWITCH mod_event_socket denial of service via Content-Length](https://junglewise.ai/threats/cve-2026-116787-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH command injection via SIP REFER URI parameters](https://junglewise.ai/threats/cve-2026-116786-freeswitch-is-a-software-defined-telecom-stack-enabling-the)