Executive brief
FreeSWITCH is a software-based telecommunications platform used to manage voice and video communications. A security flaw in its Verto module allows a user with valid credentials to inject unauthorized settings into their session by making failed login attempts before successfully logging in. This could allow an attacker to manipulate call-side variables, potentially influencing how calls are routed or handled by the system.
Technical details
A vulnerability in the mod_verto module of FreeSWITCH arises because the check_auth userauth branch writes request-supplied userVariables into the connection state before verifying the password. Since these writes are append-only and the WebSocket connection remains open after a failed authentication attempt, values from failed attempts persist and are merged with the state of a subsequent successful login on the same connection. An attacker with valid credentials can use this to inject arbitrary channel variables that flow into outbound verto.invite and inbound INVITE requests. This issue is fixed in version 1.11.1 by restructuring the authentication logic to ensure password verification occurs before any connection-state writes.
Affected products
- SignalWire FreeSWITCH <= 1.11.0
Timeline
- 2026-05-26: patched: Version 1.11.1 released
- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD