Vulnerability · Published May 19, 2026 · Assigned by VulnCheck

CVE-2026-41470LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token

Medium 5.9

In plain English

A medium-severity incorrect authorization in LIVE555 from Live Networks, Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	liblivemedia	2026.09.23-dfsg-1	DEBIAN-CVE-2026-41470
Ubuntu:26.10	liblivemedia	no fix listed	UBUNTU-CVE-2026-41470

Affected products (as reported)

Vendor	Product	Versions
Live Networks, Inc.	LIVE555	0 – before 2026.04.22

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f technical-description, exploit
https://download.live555.com/ patch, product
https://www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token third-party-advisory