CVE-2026-49848: FreeSWITCH mod_verto Session State Injection Vulnerability

Technical summary

The vulnerability exists in mod_verto's check_auth userauth branch, where the authentication flow violates the principle of verify-before-trust. The code writes request-supplied userVariables into connection state prior to password comparison. Since the writes are append-only and the connection remains open after authentication failure, an attacker can inject arbitrary userVariables through a failed login, then authenticate successfully on the same WebSocket. The injected variables from the failed attempt remain in the connection state, potentially affecting downstream logic that relies on those variables for authorization or session management decisions.

Business impact

Organizations deploying FreeSWITCH for VoIP, unified communications, or telecom infrastructure are exposed to session hijacking and authorization bypass scenarios. An authenticated attacker (or attacker with network access to Verto) could inject malicious session variables through failed authentication attempts, then authenticate legitimately to gain influence over their session context. This could lead to privilege escalation, unauthorized feature access, or cross-user session contamination if multiple users share connection pooling. The impact is limited by the requirement for authentication and the MEDIUM CVSS score, but the persistence of state across auth boundaries makes this a subtle and difficult-to-detect attack.

Affected systems

FreeSWITCH versions before 1.11.1 are vulnerable. Organizations running the Verto WebSocket module for client connectivity should prioritize inventory and version assessment. Deployment scenarios involving shared or pooled Verto connections, or multi-tenant environments, face elevated risk.

Exploitability

Exploitation requires prior authentication (hence the MEDIUM severity and PR:L requirement in CVSS). An attacker must have valid credentials or access to bypass initial auth. The attack is not particularly complex from a technical standpoint—it relies on protocol behavior rather than memory corruption or complex chaining. The append-only nature of variable writes and lack of connection state cleanup make this reliably reproducible. However, the requirement to have an initial foothold limits real-world attack surface. No known public exploit or active weaponization is documented.

Remediation

Upgrade FreeSWITCH to version 1.11.1 or later. The patch addresses this by ensuring userVariables are validated and isolated before being written to connection state, or by implementing proper state cleanup on authentication failure. Organizations unable to upgrade immediately should consider network segmentation of Verto endpoints, restrict authentication attempts per connection, or implement application-level session validation to detect and reject unexpected userVariable states.

Patch guidance

Verify that your FreeSWITCH deployment is running version 1.11.1 or later. Review the FreeSWITCH project repository or vendor advisory for specific patch details and any breaking changes. Test the update in a staging environment, particularly if you have custom Verto clients or extensions that depend on userVariable handling. Monitor connection logs for any anomalies after patching.

Detection guidance

Search for patterns of repeated failed authentication attempts followed by successful authentication on the same WebSocket connection from a single IP or user. Monitor for unexpected or unauthorized userVariable values in Verto session logs. Implement logging of userVariable state at auth boundaries and compare across auth transitions—if values from one session appear in a subsequent session on the same connection, investigate. Check Verto module debug logs for signs of state persistence across failed auth attempts.

Why prioritize this

While the CVSS is MEDIUM (4.3), this vulnerability merits prioritization because it affects authentication and session integrity, core security primitives. The append-only, persistent nature of the state manipulation makes it difficult to detect at runtime and could enable lateral moves or privilege escalation in multi-user or multi-tenant Verto deployments. The patch is straightforward and low-risk, making remediation fast relative to the underlying exposure.

Risk score, explained

CVSS 4.3 reflects the requirement for prior authentication (PR:L) and the limited scope (impacts integrity of session variables, not confidentiality or availability). The score appropriately captures that this is not a zero-day remote code execution, but rather a session management defect. However, in environments where Verto is exposed to untrusted networks or supports high-privilege user sessions, the real-world risk may exceed the base score. Organizations should also consider whether their threat model includes authenticated insiders or compromised low-privilege accounts.

Frequently asked questions