CVE-2026-14935: Gstreamer: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
A logic vulnerability was found in GStreamer's webrtcbin component (gst-plugins-bad). The checksdpcrypto() function in webrtcsdp.c contains an inverted boolean condition at lines 128-134 that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it.
The check reads: if (!ISEMPTYSDPATTRIBUTE(messagefingerprint) && !ISEMPTYSDPATTRIBUTE(mediafingerprint)) Which means: if BOTH fingerprints ARE present, reject. The correct logic should reject when both are ABSENT.
File: subprojects/gst-plugins-bad/ext/webrtc/webrtcsdp.c Function: checksdpcrypto()
An attacker who can intercept and modify the WebRTC signaling channel can remove a=fingerprint attributes from SDP messages. The vulnerable webrtcbin will accept the modified SDP, bypassing the RFC 8122 fingerprint-to-DTLS-certificate binding. This weakens defenses against man-in-the-middle attacks on media streams.
Practical impact is limited: exploitation requires MITM on the signaling channel (typically TLS-protected), and the DTLS layer may still independently validate certificates. This is a defense-in-depth bypass, not a complete cryptographic break.
Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3 and current main) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/98 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5171 (confidential)
Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19091
Other sources
A logic vulnerability was found in GStreamer's webrtcbin component. The checksdpcrypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamer gst-plugins-bad (webrtcbin)to a version that resolves this vulnerability.Fixed in 1.28.5Patch PSIRTSUPT-19091 - Configuration
Update the inverted boolean condition in _check_sdp_crypto() so the function rejects remote SDP offers/answers when both required a=fingerprint attributes are absent (correct logic: if BOTH fingerprints are present, reject; the vulnerable code accepts SDP lacking a=fingerprint due to inverted presence check at lines 128-134).
GStreamer webrtcbin (gst-plugins-bad) subprojects/gst-plugins-bad/ext/webrtc/webrtcsdp.c (_check_sdp_crypto()) SDP attribute presence check for a=fingerprint (message_fingerprint and media_fingerprint) = reject remote SDP when both fingerprints are ABSENT
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14935?
CVE-2026-14935 has a severity rating of low, with a score of 3.7.
What is the risk associated with CVE-2026-14935?
CVE-2026-14935 has a risk rating of 20, indicating a potential impact.
How does CVE-2026-14935 affect GStreamer webrtcbin?
CVE-2026-14935 affects GStreamer webrtcbin by allowing the acceptance of remote SDP offers without the required a=fingerprint attribute.
How do I fix CVE-2026-14935?
To fix CVE-2026-14935, update GStreamer to the latest version that addresses the vulnerability.
What component of GStreamer is impacted by CVE-2026-14935?
CVE-2026-14935 impacts the webrtcbin component within GStreamer.