Medium severity5.9NVD Advisory· Published May 19, 2026· Updated May 19, 2026

CVE-2026-41470

Description

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Rgaufman/Live555llm-fuzzy
Range: < 2026.04.22
osv-coords
pkg:rpm/opensuse/live555&distro=openSUSE%20Tumbleweed
Range: < 2026.04.22-1.1

Patches

Vulnerability mechanics

References

download.live555.comnvd
gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795fnvd
www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-tokennvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000