LIVE555 before 2026.04.22 contains a flaw in RTSP session command handling that allows an attacker to replay a valid Session token obtained through an unauthenticated connection. With a valid token, the attacker can issue PLAY and TEARDOWN commands from a second TCP connection without proper authorization, leading to server crashes via virtual function call errors or interruption of active streams. This results in loss of service continuity.

The vulnerability affects Live Networks, Inc. LIVE555 software versions prior to 2026.04.22. Specific affected versions are not explicitly enumerated in the provided data, but any installation relying on a release older than 2026.04.22 is at risk.

The flaw scores a CVSS of 8.2, indicating high severity. The EPSS score is not available, so exact exploitation probability cannot be quantified, but the absence of a KEV listing suggests no confirmed widespread exploitation yet. Based on the description, the likely attack vector involves remote network access to an exposed RTSP server, where malicious actors can acquire a valid Session token and replay it from a separate connection. The risk is elevated for publicly reachable RTSP services due to the potential for authentication bypass and session termination attacks.