CVE-2026-49848: 
FreeSWITCH vulnerability analysis and mitigation

CVE-2026-49848 is a pre-authentication userVariables injection vulnerability in FreeSWITCH's mod_verto module, classified as Improper Authentication (CWE-287). Prior to version 1.11.1, the check_auth userauth branch wrote request-supplied userVariables into the connection state before verifying the supplied password, allowing values from failed login attempts to persist and carry into a subsequent successful login on the same WebSocket connection. All FreeSWITCH versions up to and including 1.11.0 are affected; version 1.11.1 contains the fix. The vulnerability was published on June 9, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-287: Improper Authentication) lies in mod_verto's check_auth function, where the userauth branch performs an append-only write of attacker-controlled userVariables into the WebSocket connection state before the password comparison occurs. Because the connection is not closed on a failed authentication attempt, any userVariables injected during a bad-password request persist on the same WebSocket session. When the attacker (or a legitimate user) subsequently authenticates successfully on that same connection, the session's userVariables contain the union of all prior failed attempts' values plus the successful frame's values. These variables then flow into channel variables on outbound verto.invite calls and inbound INVITEs targeting the session. The root_passwd login path is not affected, as it compares against profile configuration and writes no connection state on either outcome (GitHub Advisory).

Successful exploitation allows an authenticated attacker to inject arbitrary userVariables into a FreeSWITCH session's channel variables, influencing call-side behavior on outbound verto.invite and inbound INVITEs targeting the session. The integrity impact is limited — there is no confidentiality breach or availability disruption — but an attacker could manipulate call routing variables or inject unexpected values into call processing logic. Only deployments with mod_verto profiles configured with userauth=true (the default in verto.conf.xml) are affected (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-49848. The vulnerability requires network access to the verto WebSocket listener (default ports 8081 plaintext and 8082 TLS) and valid credentials for at least one account on that listener — the injected values only take effect once authentication eventually succeeds on the same connection. TLS does not mitigate the issue, as the writes occur after transport termination. The EPSS score is approximately 0.026% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify FreeSWITCH instances with mod_verto enabled and userauth=true by scanning for open WebSocket ports 8081 (plaintext) or 8082 (TLS) using tools like Shodan, Censys, or nmap.
2. Establish WebSocket connection: Connect to the target's verto WebSocket endpoint (e.g., ws://<target>:8081 or wss://<target>:8082) using a WebSocket client or custom script.
3. Inject userVariables via failed login: Send a verto.login JSON-RPC request with an incorrect password but include attacker-controlled userVariables in the request payload (e.g., {"jsonrpc":"2.0","method":"login","params":{"login":"<user>","passwd":"wrongpassword","userVariables":{"malicious_var":"injected_value"}}}).
4. Authenticate successfully: On the same WebSocket connection, send a subsequent verto.login request with the correct credentials. The connection state now contains the union of the injected variables from the failed attempt and the successful login frame.
5. Trigger call with injected variables: Initiate or receive a call via verto.invite or an inbound INVITE; the injected userVariables are now present as channel variables and may influence call routing or processing logic (GitHub Advisory).

• Network: Repeated WebSocket connections to FreeSWITCH verto ports (8081/8082) from the same source IP with multiple failed authentication attempts followed by a successful login on the same connection.
• Logs: FreeSWITCH event logs showing multiple verto.login failures from the same WebSocket session ID before a successful authentication event; unusual or unexpected userVariables keys appearing in channel variable logs for calls.
• Application Behavior: Channel variables on calls containing unexpected or unknown key-value pairs not set by the legitimate authenticated user's login frame, particularly on verto.invite or inbound INVITE events.

Upgrade FreeSWITCH to version 1.11.1 or later, which restructures the userauth branch so the password comparison runs before any connection-state write, ensuring userVariables are only applied on the success path (FreeSWITCH v1.11.1 Release). If immediate upgrade is not possible, restrict the verto WebSocket listener to trusted networks via firewall rules or by binding it to a non-public interface. Alternatively, disable mod_verto entirely if it is not in active use (GitHub Advisory).

The vulnerability was discovered and reported by security researcher Adam Bedard and credited to analyst CaffinatedSquirrel-OG in the GitHub Security Advisory. The FreeSWITCH maintainers (SignalWire) described v1.11.1 as "an important release containing critical security fixes" and strongly encouraged all users to upgrade as soon as possible (FreeSWITCH v1.11.1 Release). No significant broader media coverage or social media discussion has been identified beyond standard vulnerability database aggregation.