{"id":"CVE-2021-28681","aliases":["EUVD-2021-0985","GHSA-74xm-qj29-cq8p","GO-2021-0104"],"status":"published","title":"In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication","description":"Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00677,"percentile":0.52721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2021-03-18T03:20:06Z","modified":"2026-10-20T10:54:38Z","fixes":[{"ecosystem":"Go","package":"github.com/pion/webrtc/v3","fixed_in":["3.0.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/pion/webrtc/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pion/webrtc/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/pion/webrtc/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.15"}]}]}],"products":[{"vendor":"webrtc_project","product":"webrtc"}],"references":[{"url":"https://github.com/pion/webrtc/issues/1708","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28681","tags":["advisory"]},{"url":"https://github.com/pion/webrtc/pull/1709","tags":["web","fix"]},{"url":"https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0104","tags":["web"]},{"url":"https://github.com/advisories/GHSA-74xm-qj29-cq8p"},{"url":"https://github.com/pion/webrtc","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-28681","description":"Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)","status":"published","published":"2021-03-18T03:20:06Z","modified":"2024-08-03T21:47:33.209Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0985","description":"Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)","status":"published","published":"2021-03-18T03:20:06Z","modified":"2024-08-03T21:47:33Z","updated_at":"2026-11-03T03:24:46.751124Z"}],"ghsa":[{"id":"GHSA-74xm-qj29-cq8p","title":"In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication","description":"### Impact\nData channel communication was incorrectly allowed with users who have failed DTLS certificate verification.\n\nThis attack requires \n* Attacker knows the ICE password. \n* Only take place during PeerConnection handshake.\n\nThis attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.\n\n### Patches\nUsers should upgrade to v3.0.15. \n\nThe exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e\n\n### Workarounds\nUsers should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/pion/webrtc\n* Email us at [team@pion.ly](mailto:team@pion.ly)\n\nThank you to https://github.com/Gaukas for discovering this.","status":"published","published":"2021-05-25T18:42:42Z","modified":"2023-08-29T23:21:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-28681","description":"Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)","status":"published","published":"2021-03-18T04:15:14.617Z","modified":"2026-06-17T03:46:47.087Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-28681","description":"Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)","status":"published","published":"2021-03-18T04:15:14.617Z","modified":"2026-10-20T10:54:38.816168057Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-74xm-qj29-cq8p","title":"In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication","description":"### Impact\nData channel communication was incorrectly allowed with users who have failed DTLS certificate verification.\n\nThis attack requires \n* Attacker knows the ICE password. \n* Only take place during PeerConnection handshake.\n\nThis attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.\n\n### Patches\nUsers should upgrade to v3.0.15. \n\nThe exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e\n\n### Workarounds\nUsers should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/pion/webrtc\n* Email us at [team@pion.ly](mailto:team@pion.ly)\n\nThank you to https://github.com/Gaukas for discovering this.","status":"published","published":"2021-05-25T18:42:42Z","modified":"2026-07-08T06:28:01.869413904Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"GO-2021-0104","title":"Authorization bypass in github.com/pion/webrtc/v3","description":"Due to improper error handling, DTLS connections were not killed when certificate verification failed, causing users who did not check the connection state to continue to use the connection. This could allow allow an attacker which holds the ICE password, but not a valid certificate, to bypass this restriction.","status":"published","published":"2021-07-28T18:08:05Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}