PT-2026-41997 · Live555 · Live555

Vulncheck · Published 2026-05-19 · Updated 2026-05-28 · CVE-2026-41470

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LIVE555 versions prior to 2026.04.22

Description An authorization bypass exists in the RTSP session command handling. This allows attackers to replay valid Session tokens from unauthenticated connections. By obtaining a valid Session token, an attacker can issue 'PLAY' and 'TEARDOWN' commands from a separate TCP connection without authentication. This can lead to server crashes due to virtual function call errors or the disruption of active streams by terminating victim sessions.

Recommendations Update to version 2026.04.22.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41470

OPENSUSE-SU-2026:10881-1

Affected Products

Live555

References · 11

• 🔥 https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f · Exploit
• https://cve.org/CVERecord?id=CVE-2026-41470 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41470 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10881-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41470 · Security Note
• https://download.live555.com · Patch
• https://ubuntu.com/security/CVE-2026-41470 · Vendor Advisory
• https://vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token · Note
• https://twitter.com/CVEnew/status/2056870191586230282 · Twitter Post
• https://t.me/CVEtracker/54282 · Telegram Post
• https://suse.com/security/cve/CVE-2026-41470 · Note