CVE-2026-41470
CVE-2026-41470 · LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.
CVSS 8.2 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
live555
- Versions
- ≥ 0, < 2026.04.22: Affected (custom)
Update to 2026.04.22
liblivemedia Debian:14
- Versions
- 2004.11.11a-1
- 2005.04.01-1
- 2005.06.16-1
- 2005.07.21-1
- 2005.10.05-1
- 2006.03.17-1
- 2006.03.17-2
- 2007.02.20-1
- 2007.02.20-2
- 2008.07.25-1
- 2008.07.25-2
- 2009.11.27-1
- 2010.02.10-1
- 2010.04.09-1
- 2010.11.17-1
- 2011.03.14-1
- 2011.05.25-1
- 2011.06.16-1
- 2011.07.08-1
- 2011.07.21-1
- 2011.08.22-1
- 2011.09.02-1
- 2011.12.23-1
- 2012.02.04-1
- 2012.02.29-1
- 2012.02.29-2
- 2012.04.04-1
- 2012.04.21-1
- 2012.05.03-1
- 2012.05.03-1~bpo60+1
- 2012.05.17-1
- 2012.05.17-1+wheezy1
- 2012.05.17-1~bpo60+1
- 2012.08.31-1
- 2012.10.24-1
- 2012.11.16-1
- 2012.11.30-1
- 2013.01.05-1
- 2013.01.05-2
- 2013.01.05-3
- 2013.01.15-1
- 2013.04.30-1
- 2013.10.25-1
- 2014.01.13-1
- 2015.12.22-1
- 2016.01.12-1
- 2016.01.16-1
- 2016.01.20-1
- 2016.01.29-1
- 2016.01.29-2
- 2016.02.09-1
- 2016.03.16-1
- 2016.04.01-1
- 2016.04.21-1
- 2016.06.26-1
- 2016.07.19-1
- 2016.08.07-1
- 2016.08.27-1
- 2016.09.22-1
- 2016.11.06-1
- 2016.11.17-1
- 2016.11.28-1
- 2017.01.26-1
- 2017.04.10-1
- 2017.04.26-1
- 2017.06.04-1
- 2017.06.04-2
- 2017.07.18-1
- 2017.09.12-1
- 2017.10.28-1
- 2017.10.28-2
- 2018.01.24-1
- 2018.01.29-1
- 2018.02.18-1
- 2018.02.28-1
- 2018.04.25-1
- 2018.04.25-2
- 2018.07.07-1
- 2018.08.05-1
- 2018.08.27-1
- 2018.08.27-2
- 2018.08.28a-1
- 2018.09.06-1
- 2018.09.10-1
- 2018.09.18-1
- 2018.10.17-1
- 2018.11.26-1
- 2018.11.26-1.1
- 2019.02.03-1
- 2019.02.27-1
- 2019.03.06-1
- 2019.04.24-1
- 2019.05.12-1
- 2019.06.28-1
- 2019.07.27-1
- 2019.08.16-1
- 2019.08.28-1
- 2019.09.30-1
- 2019.10.11-1
- 2019.10.11-2
- 2020.01.11-1
- 2020.01.19-1
- Affected ranges
- ECOSYSTEM: < 2026.09.23-dfsg-1
Update to 2026.09.23-dfsg-1
liblivemedia Ubuntu:Pro:16.04:LTS
- Versions
- 2014.01.13-1
- 2016.01.29-2
- 2016.02.09-1
- 2016.02.09-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
liblivemedia Ubuntu:Pro:18.04:LTS
- Versions
- 2017.07.18-1
- 2017.09.12-1ubuntu1
- 2017.10.28-2
- 2018.01.29-1
- 2018.02.18-1
- 2018.02.18-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
liblivemedia Ubuntu:20.04:LTS
- Versions
- 2018.11.26-1.1
- 2020.01.19-1
- 2020.01.19-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
liblivemedia Ubuntu:26.10
- Versions
- 2026.09.23-dfsg-1
- 2026.09.23-dfsg-3
- 2026.09.23-dfsg-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published