CVE-2025-66378: 
Pexip Infinity Management Node vulnerability analysis and mitigation

CVE-2025-66378 is an incorrect authorization vulnerability in Pexip Infinity's RTMP implementation that allows unauthenticated remote attackers to disconnect active RTMP streams traversing a Proxy Node. It affects Pexip Infinity versions 38.0 and 38.1 (before 39.0), disclosed on December 25, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NVD, though ENISA's EUVD rates it 5.9 (Medium) under a higher-complexity vector (Red Hat CVE, Pexip Security Bulletins).

The root cause is classified as CWE-863 (Incorrect Authorization) — the RTMP implementation in Pexip Infinity's Proxy Node fails to properly enforce access controls on stream management operations. An unauthenticated network attacker can send crafted RTMP control messages to a Proxy Node to forcibly terminate RTMP streams belonging to other users or sessions. No privileges or user interaction are required, and the attack is conducted entirely over the network with low complexity (Red Hat CVE, Pexip Security Bulletins).

Successful exploitation results in a denial-of-service condition specifically targeting RTMP media streams routed through Pexip Infinity Proxy Nodes. An attacker can disrupt live video/audio streaming sessions without any authentication, impacting availability of conferencing services. There is no confidentiality or integrity impact — data is not exposed or modified, but ongoing RTMP-based communications can be arbitrarily terminated (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term (Red Hat CVE, Pexip Security Bulletins).

• Network: Unexpected or repeated RTMP connection attempts to Proxy Node endpoints from unknown or external IP addresses; anomalous RTMP control messages (e.g., stream disconnect commands) not associated with legitimate session participants.
• Logs: Pexip Infinity logs showing RTMP streams being terminated unexpectedly without corresponding user-initiated disconnect events; repeated stream teardown events from a single source IP.
• Process/Service: Sudden drops in active RTMP stream counts on Proxy Nodes without corresponding conference end events in the management interface.

Pexip has released version 39.0 of Pexip Infinity, which resolves this vulnerability. Organizations running versions 38.0 or 38.1 should upgrade to 39.0 or later as the primary remediation. As a temporary workaround, restricting network access to RTMP ports on Proxy Nodes to trusted IP ranges can reduce exposure until patching is feasible (Pexip Security Bulletins).

The vulnerability received limited public attention, with coverage primarily from automated CVE tracking services and vulnerability aggregators. A brief mention appeared on Bluesky via the CVE tracking account, and a technical summary was published by Infinitsec (Infinitsec Post). No significant vendor statements beyond the security bulletin or notable researcher commentary have been identified.