CVE-2026-49848: FreeSWITCH mod_verto userVariables injection in check_auth

CVE-2026-49848 · Severity: medium · CVSS 4.3 · Published 2026-06-09

FreeSWITCH is a software-based telecommunications platform used to manage voice and video communications. A security flaw in its Verto module allows a user with valid credentials to inject unauthorized settings into their session by making failed login attempts before successfully logging in. This could allow an attacker to manipulate call-side variables, potentially influencing how calls are routed or handled by the system.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-49848 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49848 being exploited in the wild.
How severe is CVE-2026-49848?
Medium severity, with a CVSS score of 4.3, published 9 June 2026.
Which products and versions are affected?
SignalWire FreeSWITCH <= 1.11.0.
Is there a fix for CVE-2026-49848?
A patch was published on 2026-05-26: Version 1.11.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49848 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49848?
Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the mod_verto module of FreeSWITCH arises because the check_auth userauth branch writes request-supplied userVariables into the connection state before verifying the password. Since these writes are append-only and the WebSocket connection remains open after a failed authentication attempt, values from failed attempts persist and are merged with the state of a subsequent successful login on the same connection. An attacker with valid credentials can use this to inject arbitrary channel variables that flow into outbound verto.invite and inbound INVITE requests. This issue is fixed in version 1.11.1 by restructuring the authentication logic to ensure password verification occurs before any connection-state writes.

Affected products

  • SignalWire FreeSWITCH <= 1.11.0

Timeline

  • 2026-05-26: patched: Version 1.11.1 released
  • 2026-06-03: advisory: GitHub Security Advisory published
  • 2026-06-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.