CVE-2026-49843: 
FreeSWITCH vulnerability analysis and mitigation

CVE-2026-49843 is a pre-authentication session eviction vulnerability in FreeSWITCH's mod_verto module, classified as Improper Authentication (CWE-287). The flaw allows an unauthenticated remote attacker who knows a target session UUID to evict a legitimate client from the global session hash, disrupting active calls and closing the victim's WebSocket connection. All FreeSWITCH versions up to and including 1.11.0 are affected; the issue was patched in version 1.11.1, released May 26, 2026, with the CVE published on June 9, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-287) lies in mod_verto's JSON-RPC handler, which binds an incoming WebSocket connection to the client-supplied sessid on the very first frame — before any authentication check is performed. This binding inserts the connection into the global session hash; if the supplied sessid collides with an existing entry, the prior occupant is evicted: it receives a verto.punt message, its calls are detached, and its socket is closed. The fix in v1.11.1 moves the sessid-to-connection bind past the authentication gate, so unauthenticated frames fail check_auth and return before reaching the bind logic. The attack requires network access to the verto WebSocket listener (default ports 8081/plaintext or 8082/TLS) and prior knowledge of the target session UUID; TLS does not mitigate the issue since the bind occurs after transport termination (GitHub Advisory, FreeSWITCH v1.11.1 Release).

Successful exploitation results in a targeted denial-of-service against a specific verto session: the legitimate client is forcibly disconnected, its active calls are detached, and its WebSocket is closed. The attacker's connection occupies the UUID slot but cannot invoke authenticated methods, so this is not a credential bypass or a path to session takeover — confidentiality and integrity are unaffected. The practical impact is limited to availability disruption for the targeted session, which can be significant in production VoIP/telecom environments where call continuity is critical (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.057%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Practical exploitation requires prior knowledge of a target session UUID, which is a 128-bit random value — blind enumeration is infeasible, and attacks depend on UUID leakage via side channels such as server logs or application-layer event delivery (GitHub Advisory, Feedly).

1. Reconnaissance: Identify FreeSWITCH deployments with mod_verto enabled and the WebSocket listener reachable (default ports 8081 for plaintext, 8082 for TLS). Tools like Shodan or Censys can be used to locate exposed instances.
2. Obtain target session UUID: Acquire the victim's session UUID via a side channel — e.g., server log access, application-layer event leakage, or deployment-specific information disclosure. Blind guessing of 128-bit UUIDs is not feasible.
3. Craft malicious JSON-RPC frame: Construct a WebSocket connection to the verto listener and send an initial JSON-RPC frame containing the target's sessid as the client-supplied session identifier, before any authentication is attempted.
4. Trigger session eviction: The server's JSON-RPC handler binds the attacker's connection to the supplied sessid in the global session hash. On collision with the legitimate session, the server sends a verto.punt to the victim, detaches its calls, and closes its socket.
5. Result: The legitimate client is evicted and its active calls are dropped. The attacker's connection holds the UUID slot but cannot proceed past the authentication gate without valid credentials (GitHub Advisory).

• Network: Unexpected WebSocket connection attempts to ports 8081 or 8082 from untrusted IP addresses; connections that send a single JSON-RPC frame and do not proceed to authentication.
• Logs: FreeSWITCH logs showing verto.punt events sent to legitimate sessions followed immediately by a new connection binding to the same sessid; abrupt session termination entries without corresponding client-initiated disconnect.
• Process/Application: Active calls being unexpectedly detached or dropped without client-side indication; legitimate verto clients reporting sudden disconnection with a verto.punt message.

Upgrade FreeSWITCH to version 1.11.1 or later, which moves the sessid bind past the authentication gate, preventing unauthenticated eviction. As an interim workaround, restrict the verto WebSocket listener (ports 8081/8082) to trusted networks using firewall rules or by configuring a restricted bind address. If mod_verto is not actively used, disabling the module entirely eliminates the attack surface (GitHub Advisory, FreeSWITCH v1.11.1 Release).

The advisory was published by SignalWire maintainer andywolk on GitHub on June 3, 2026, crediting security researcher Adam Bedard for discovery. The release notes for v1.11.1 describe it as "an important release containing critical security fixes" and strongly encourage all users to upgrade. No significant broader media coverage or notable community debate has been identified beyond standard CVE tracking and aggregator entries.