Medium severity5.9NVD Advisory· Published May 19, 2026· Updated Jul 24, 2026
CVE-2026-41470
CVE-2026-41470
Description
LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versionspkg:rpm/opensuse/live555&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/live555&distro=openSUSE%20Leap%2016.0
< 2026.04.22-1.1+ 1 more
- (no CPE)range: < 2026.04.22-1.1
- (no CPE)range: < 2026.08.25-bp160.1.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.