{"id":"CVE-2026-41470","aliases":["DEBIAN-CVE-2026-41470","EUVD-2026-30973","GHSA-3x7c-xg4r-972q","UBUNTU-CVE-2026-41470","openSUSE-SU-2026:10881-1","openSUSE-SU-2026:21863-1"],"status":"published","title":"LIVE555 \u003c 2026.04.22 RTSP Server Authorization Bypass via Session Token","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0048,"percentile":0.41901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-05-19T18:43:49Z","modified":"2026-10-17T12:58:15Z","fixes":[{"ecosystem":"Debian:14","package":"liblivemedia","fixed_in":["2026.09.23-dfsg-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"live555","fixed_in":["2026.04.22-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.09.23-dfsg-1"}]}],"versions":["2004.11.11a-1","2005.04.01-1","2005.06.16-1","2005.07.21-1","2005.10.05-1","2006.03.17-1","2006.03.17-2","2007.02.20-1","2007.02.20-2","2008.07.25-1","2008.07.25-2","2009.11.27-1","2010.02.10-1","2010.04.09-1","2010.11.17-1","2011.03.14-1","2011.05.25-1","2011.06.16-1","2011.07.08-1","2011.07.21-1","2011.08.22-1","2011.09.02-1","2011.12.23-1","2012.02.04-1","2012.02.29-1","2012.02.29-2","2012.04.04-1","2012.04.21-1","2012.05.03-1","2012.05.03-1~bpo60+1","2012.05.17-1","2012.05.17-1+wheezy1","2012.05.17-1~bpo60+1","2012.08.31-1","2012.10.24-1","2012.11.16-1","2012.11.30-1","2013.01.05-1","2013.01.05-2","2013.01.05-3","2013.01.15-1","2013.04.30-1","2013.10.25-1","2014.01.13-1","2015.12.22-1","2016.01.12-1","2016.01.16-1","2016.01.20-1","2016.01.29-1","2016.01.29-2","2016.02.09-1","2016.03.16-1","2016.04.01-1","2016.04.21-1","2016.06.26-1","2016.07.19-1","2016.08.07-1","2016.08.27-1","2016.09.22-1","2016.11.06-1","2016.11.17-1","2016.11.28-1","2017.01.26-1","2017.04.10-1","2017.04.26-1","2017.06.04-1","2017.06.04-2","2017.07.18-1","2017.09.12-1","2017.10.28-1","2017.10.28-2","2018.01.24-1","2018.01.29-1","2018.02.18-1","2018.02.28-1","2018.04.25-1","2018.04.25-2","2018.07.07-1","2018.08.05-1","2018.08.27-1","2018.08.27-2","2018.08.28a-1","2018.09.06-1","2018.09.10-1","2018.09.18-1","2018.10.17-1","2018.11.26-1","2018.11.26-1.1","2019.02.03-1","2019.02.27-1","2019.03.06-1","2019.04.24-1","2019.05.12-1","2019.06.28-1","2019.07.27-1","2019.08.16-1","2019.08.28-1","2019.09.30-1","2019.10.11-1","2019.10.11-2","2020.01.11-1","2020.01.19-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2014.01.13-1","2016.01.29-2","2016.02.09-1","2016.02.09-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2017.07.18-1","2017.09.12-1ubuntu1","2017.10.28-2","2018.01.29-1","2018.02.18-1","2018.02.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2018.11.26-1.1","2020.01.19-1","2020.01.19-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"liblivemedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2026.09.23-dfsg-1","2026.09.23-dfsg-3","2026.09.23-dfsg-4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"live555","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.04.22-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"live555","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.08.25-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"live networks, inc.","product":"live555"}],"references":[{"url":"https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f","tags":["technical-description","exploit"]},{"url":"https://download.live555.com/","tags":["patch","product"]},{"url":"https://www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41470"},{"url":"https://download.live555.com"},{"url":"https://github.com/advisories/GHSA-3x7c-xg4r-972q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41470","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41470","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41470","tags":["web"]},{"url":"https://bugzilla.suse.com/1265856","tags":["report"]},{"url":"https://bugzilla.suse.com/1279932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38998","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-41470","title":"LIVE555 \u003c 2026.04.22 RTSP Server Authorization Bypass via Session Token","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T18:43:49.652Z","modified":"2026-07-14T20:00:54.364Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-30973","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T18:43:49Z","modified":"2026-07-14T20:00:54Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:58.805605Z"}],"ghsa":[{"id":"GHSA-3x7c-xg4r-972q","title":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command...","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T21:32:03Z","modified":"2026-05-19T21:32:09Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:08:12.634242Z"}],"nvd":[{"id":"CVE-2026-41470","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T19:16:50.44Z","modified":"2026-07-24T09:10:00.153Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"DEBIAN-CVE-2026-41470","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T19:16:50.44Z","modified":"2026-10-05T04:00:11.042473691Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-41470","description":"LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.","status":"published","published":"2026-05-19T19:16:00Z","modified":"2026-10-17T12:58:15.119813787Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"openSUSE-SU-2026:10881-1","title":"libBasicUsageEnvironment2-2026.04.22-1.1 on GA media","description":"These are all security issues fixed in the libBasicUsageEnvironment2-2026.04.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-05-29T08:15:06.439073085Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21863-1","title":"Security update for live555","description":"This update for live555 fixes the following issues:\n\nChanges in live555:\n\n- Update to version 2026.08.25:\n  * Fixed a bug in \"VorbisAudioRTPSource\" that could have caused a\n    malicious SDP description to crash a RTP client.\n\n- update to 2026.08.14:\n  * Fixed a bug that could cause a problem with subclassed variants\n    of H.264 or H.265 RTP sinks.\n  * Fixed old code in \"GroupsockHelper.cpp\" that was using\n    hardcoded numeric error numbers\n  * Fixed a memory leak that could occur when parsing a SDP\n    description that contains two or more\n  * When adding protection against the use of 'stolen' RTSP session\n    ids we forgot to do so for every \"SETUP\" command.  This release\n    fixes that.\n  * Fixed a typo in \"RTSPCommon.cpp\": \"smtpe\" -\u003e \"smpte\".\n  * Updated the RTSP server implementation to return a \"Unsupported\n    Transport\" error if a \"SETUP\" request does not include a\n    \"Transport:\" header.\n  * Added \"-std=c++20\" to the \"CPLUSPLUS_FLAGS\" line in each\n    \"config.*\" file, so that \"std::atomic_flag::test\" will compile\n    with compilers that support\n  * Made the parsing of MP3 audio files more robust to protect\n    against malformed MP3 data.\n  * Minor change to \"testProgs/testRTSPClient.cpp\" to make\n    compiling on Mac OS X happier.\n\n- Update to version 2026.06.01:\n  * Updated the \"RTSPServer\" implementation of the \"SETUP\" command\n    to make it more robust if subclassed code reimplements\n    \"lookupServerMediaSession()\" as an asynchronous operation.\n\n- update to 2026.05.30:\n  * Updated the \"RTSPServer\" implementation some more to make it\n    more robust if subclassed code reimplements\n    \"lookpServerMediaSession()\" as an asynchronous operation.\n  * Added an (integer) index to identify each server's\n    'client connection', and changed the \"fClientConnections\" table\n    to be indexed by this id.\n  * In the \"RTSPServer\" implementation, removed the\n    \"fOurClientConnection\" member variable.\n    This had been left over from when the RTSP \"SETUP\" command had\n    been implemented as a single, synchronous function.\n    Now that \"SETUP\" is implemented using multiple functions,\n    possibly asynchronously (depending upon how\n    \"lookpServerMediaSession()\" is implemented), this member\n    variable was potentially dangerous if more than one \"SETUP\" is\n    performed concurrently on the same client connection, or on\n    separate client connections.\n\n- update to 2026.05.28:\n  * fix use-after-free memory corruption introduced in fix\n    for CVE-2026-41470\n\n- Update to version 2026.04.22 (CVE-2026-41470, boo#1265856):\n  * Added extra checking to the handling of the RTSP server's\n    \"PLAY\", \"PAUSE\", \"TEARDOWN\", and \"SET_PARAMETER\" commands, to\n    ensure that, if the session is authenticated, then a proper\n    authentication check is done before these commands are handled.\n    This protects against the use of a 'stolen' RTSP session id to\n    send these commands.  (Note, however, that if the session is\n    not authenticated (i.e., no username,password is needed), then no\n    such protection is possible.)\n- Changes from version 2026-04-01:\n  * Updated the way that the RTSP server generates successive RTSP\n    'session ids' to make it less likely that an attacker could\n    guess a session id.\n  * Updated the RTSP server implementation to make it possible for\n    a client to request both interleaved (i.e., RTP/RTCP-over-TCP)\n    and non-interleaved (i.e., RTP/RTCP-over-UDP) delivery within\n    the same session.\n\n- Update to version 2026.03.23 (boo#1279932):\n  * CVE-2026-38998: Fixed a bug in the RTSP server code that caused\n    it to improperly handle non-interleaved \"SETUP\"s that were sent\n    for a session where interleaving (i.e., RTP/RTCP-over-TCP) had\n    already been \"SETUP\".  (This could cause a 'use-after-free'\n    error.\n  * For changes between 2024.08.01 to today, please refer to\n    https://download.live555.com/changelog.txt\n\n- update to 2024-08-01:\n  * Updated \"ServerMediaSession::generateSDPDescription()\" to\n    treat \"time_t\" as (long long).\n","status":"published","published":"2026-09-16T15:16:27Z","modified":"2026-09-17T18:23:14.637807206Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}