CVE-2026-14935
Description
A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
Statement
This vulnerability is rated as Low severity because exploitation requires man-in-the-middle access to the WebRTC signaling channel, which is typically TLS-protected. Additionally, the DTLS layer may still independently validate certificates, limiting the practical impact of this bypass. The webrtcbin component is shipped as part of gstreamer1-plugins-bad-free in Red Hat Enterprise Linux 8, 9, 10, and RHIVOS. The vulnerability weakens one layer of defense-in-depth but does not constitute a complete cryptographic break.
Mitigation
There is no complete mitigation for this vulnerability. The following measures can reduce risk:
1. Ensure WebRTC signaling channels use TLS encryption to prevent SDP modification in transit.
2. If WebRTC functionality is not required, remove the webrtcbin plugin shared object from the GStreamer plugins directory (typically /usr/lib64/gstreamer-1.0/libgstwebrtc.so).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat CVSS v3 Score Explanation
AV:N - signaling channel is network-accessible. AC:H - requires MITM on signaling channel AND DTLS layer may still validate independently; multiple conditions must align. PR:N - no authentication required to send modified SDP. UI:N - no user interaction needed. S:U - stays within same trust boundary. C:N - does not directly enable media decryption. I:L - weakens security posture by bypassing one validation layer but does not guarantee full MITM. A:N - no availability impact.
Understanding the Weakness (CWE)
Other
Technical Impact: Other; Alter Execution Logic
Acknowledgements
Red Hat would like to thank Clouditera Security (Clouditera), NSFOCUS (NSFOCUS), and Z.ai Security (Z.ai) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
