CVE-2026-49843: FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

Vulnerability summary

CVE-2026-49843 is a medium (CVSS 5.3) Improper Authentication vulnerability in freeswitch. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 21.1% of scored vulnerabilities.

Timeline

1. 09-06-2026
   PublishedVulnerability first disclosed.
2. 10-06-2026
   Last modifiedVulnerability information updated.

Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot — sending it a verto.punt, detaching its calls, and closing its socket. An unauthenticated network attacker who knows a target session UUID could therefore evict the legitimate client. This issue has been patched in version 1.11.1.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.