CVE-2026-14935 Details
Description
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
A logic vulnerability exists in the GStreamer webrtcbin component, specifically within the _check_sdp_crypto() function. The vulnerability arises from an inverted boolean condition that improperly handles SDP attributes related to DTLS certificate fingerprints. As a result, the function accepts SDP messages that lack the a=fingerprint attribute while incorrectly rejecting those that include it. This flaw can be exploited by an attacker who intercepts and modifies WebRTC signaling messages, allowing them to bypass the fingerprint binding required for DTLS certificate validation. Consequently, this vulnerability weakens the protection against man-in-the-middle attacks on media streams.
Users can mitigate this vulnerability by ensuring that WebRTC signaling channels are encrypted with TLS to prevent unauthorized modification of SDP messages in transit. If the webrtcbin component is not needed, it can be removed from the GStreamer plugins directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-670 | Always-Incorrect Control Flow Implementation | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |