Vulnerability · Published May 14, 2026 · Assigned by GitHub_M

CVE-2026-44700Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake

High 8.7

In plain English

A high-severity improper certificate validation in ex_webrtc from elixir-webrtc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.

Affected products (as reported)

Vendor	Product	Versions
elixir-webrtc	ex_webrtc	< 0.15.1>= 0.16.0, < 0.16.1

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c x_refsource_CONFIRM
https://github.com/elixir-webrtc/ex_webrtc/issues/249 x_refsource_MISC
https://github.com/elixir-webrtc/ex_webrtc/pull/250 x_refsource_MISC
https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1 x_refsource_MISC
https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1 x_refsource_MISC