CVE-2025-66378CWE-863broken-access-control

CVE-2025-66378

Medium · published December 25, 2025

CVSS v3.1

5.9

EPSS

Percentile

16.1

In the wild

Unconfirmed

What it is

Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.

The record

Technical detail

CVSS v3.1: 5.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00254 · 16.1th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-12-25T10:16Z

Affected products (1)

Product	Versions	Fixed in
pexip/pexip_infinity	≥ 38.0, < 39.0	39.0

References (1)

https://docs.pexip.com/admin/security_bulletins.htm · [email protected]

EPSS history

Timeline

25 DEC 00:00Z
Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing…
cvelistv5