A logic flaw in GStreamer’s webrtcbin component causes its internal _check_sdp_crypto() function to accept remote SDP offers or answers that lack the mandatory a=fingerprint attribute while incorrectly rejecting those that contain it. By removing the DTLS certificate fingerprint binding, the flaw allows an attacker to bypass the media‑stream integrity checks that normally prevent man‑in‑the‑middle tampering.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 ship unpatched instances of the webrtcbin plugin, typically located at /usr/lib64/gstreamer-1.0/libgstwebrtc.so. Because specific package version numbers are not provided, any RHEL release that includes the default GStreamer installation is potentially vulnerable until the plugin is removed or updated.

The CVSS score of 3.7 places this issue in the low‑to‑moderate severity range, and the EPSS score is less than 1 %. The vulnerability is not catalogued in CISA’s KEV. Exploitation requires an attacker to intercept or modify WebRTC signaling messages, which can occur by compromising the signaling server, an intermediate network hop, or a man‑in‑the‑middle position. Once a malicious SDP can be injected, the lack of a fingerprint binding permits an attacker to perform a man‑in‑the‑middle attack on the media stream.