A logic flaw in GStreamer’s webrtcbin component causes the internal _check_sdp_crypto() function to accept remote SDP offers or answers that lack the mandatory a=fingerprint attribute while incorrectly rejecting those that contain it. This inverted boolean condition removes the DTLS certificate fingerprint binding from the media session, allowing an attacker path from tampering.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 ship the unpatched webrtcbin plugin, typically located in /usr/lib64/gstreamer-1.0/libgstwebrtc.so. Because specific package version numbers are not listed, all RHEL releases that include the default GStreamer installation are potentially vulnerable until the plugin is removed or updated.

The CVSS score of 3.7 places this issue in the low‑to‑moderate severity range, and the EPSS score is less than 1 %. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to intercept or modify the signaling server or the network path between peers. Once an attacker can inject a malicious SDP, the lack of a fingerprint binding permits man‑in‑the‑middle attacks on the media stream, but the execution or privilege escalation.