CVE-2026-49848 Details
Description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes are append-only and the connection is not closed on a failed compare, so values declared on bad-password attempts persisted on the same WebSocket and carried into a subsequent successful login on that connection. This issue has been patched in version 1.11.1.
A vulnerability exists in FreeSWITCH versions prior to 1.11.1 within the mod_verto module's user authentication process. The issue arises because user-supplied variables are written into the connection state before the password is verified. This append-only write process allows values from failed password attempts to persist on the same WebSocket connection. Consequently, these values can be carried over into a subsequent successful login, potentially allowing an authenticated user to manipulate call-side variables based on earlier failed attempts.
Users can upgrade to FreeSWITCH version 1.11.1 or later, where this vulnerability has been patched. Additionally, if mod_verto is not in use, it can be disabled altogether.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 | [email protected] | Release Notes |
| https://github.com/signalwire/freeswitch/security/advisories/GHSA-j38x-xm7f-9p2f | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freeswitch freeswitch | < 1.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | New CVE Received | [email protected] |