CVE-2026-44700

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44700", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T17:07:09.317Z", "datePublished": "2026-05-14T20:51:03.877Z", "dateUpdated": "2026-05-15T11:22:24.715Z"}, "containers": {"cna": {"title": "Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c"}, {"name": "https://github.com/elixir-webrtc/ex_webrtc/issues/249", "tags": ["x_refsource_MISC"], "url": "https://github.com/elixir-webrtc/ex_webrtc/issues/249"}, {"name": "https://github.com/elixir-webrtc/ex_webrtc/pull/250", "tags": ["x_refsource_MISC"], "url": "https://github.com/elixir-webrtc/ex_webrtc/pull/250"}, {"name": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1"}, {"name": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1"}], "affected": [{"vendor": "elixir-webrtc", "product": "ex_webrtc", "versions": [{"version": "< 0.15.1", "status": "affected"}, {"version": ">= 0.16.0, < 0.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T20:51:03.877Z"}, "descriptions": [{"lang": "en", "value": "Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1."}], "source": {"advisory": "GHSA-qwfw-ggxw-577c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T11:22:11.028845Z", "id": "CVE-2026-44700", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T11:22:24.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44700", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T11:22:11.028845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T11:22:19.343Z"}}], "cna": {"title": "Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake", "source": {"advisory": "GHSA-qwfw-ggxw-577c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "elixir-webrtc", "product": "ex_webrtc", "versions": [{"status": "affected", "version": "< 0.15.1"}, {"status": "affected", "version": ">= 0.16.0, < 0.16.1"}]}], "references": [{"url": "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c", "name": "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/elixir-webrtc/ex_webrtc/issues/249", "name": "https://github.com/elixir-webrtc/ex_webrtc/issues/249", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/elixir-webrtc/ex_webrtc/pull/250", "name": "https://github.com/elixir-webrtc/ex_webrtc/pull/250", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1", "name": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1", "name": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T20:51:03.877Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44700", "state": "PUBLISHED", "dateUpdated": "2026-05-15T11:22:24.715Z", "dateReserved": "2026-05-07T17:07:09.317Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T20:51:03.877Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ex_webrtc", "vendor": "elixir-webrtc", "versions": [{"status": "affected", "version": "< 0.15.1"}, {"status": "affected", "version": ">= 0.16.0, < 0.16.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1."}, {"lang": "es", "value": "Elixir WebRTC es una implementaci\u00f3n de Elixir de la API WebRTC del W3C. Antes de las versiones 0.15.1 y 0.16.1, la falta de validaci\u00f3n de la huella digital del certificado de par DTLS en el rol de cliente DTLS (activo) elimina uno de los lados de la autenticaci\u00f3n mutua de WebRTC. El error no es explotable de forma independiente para la interceptaci\u00f3n de medios en implementaciones est\u00e1ndar, pero permite un ataque completo de man-in-the-middle cuando se encadena con se\u00f1alizaci\u00f3n insegura o un par con brechas de validaci\u00f3n similares. Esta vulnerabilidad est\u00e1 corregida en las versiones 0.15.1 y 0.16.1."}], "id": "CVE-2026-44700", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44700", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T11:22:11.028845Z", "version": "2.0.3"}}]}, "published": "2026-05-14T21:16:47.907", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/elixir-webrtc/ex_webrtc/issues/249"}, {"source": "security-advisories@github.com", "url": "https://github.com/elixir-webrtc/ex_webrtc/pull/250"}, {"source": "security-advisories@github.com", "url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.15.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.16.0,0.16.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ex_webrtc", "source": "cna", "vendor": "elixir-webrtc"}, "product": "ex_webrtc", "vendor": "elixir-webrtc"}], "created": "2026-05-14T23:00:13.250296+00:00", "updated": "2026-05-17T17:01:55.816293+00:00", "vendors": ["elixir-webrtc", "elixir-webrtc$PRODUCT$ex_webrtc"]}