CVE-2026-41470CWE-863

LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token

High · published May 19, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-19T18:43Z
EPSS history
Timeline
  • 19 MAY 18:43Z
    LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token
    cvelistv5