This vulnerability allows PJSIP to accept TLS connections presenting invalid or untrusted certificates even when the application explicitly enables certificate verification. The GnuTLS backend silently skips certificate chain validation, enabling an attacker to pose as a legitimate server or client and intercept or modify media streams. The weakness is catalogued as CWE‑295 (Improper Certificate Validation).

The problem affects the PJSIP multimedia communication library (pjproject) on builds that use GnuTLS as the TLS backend. Versions prior to 2.17 are vulnerable; the patch was incorporated in release 2.17 and later.

The CVSS score of 8.2 indicates a high severity with serious implications for confidentiality and integrity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an adversary establishing a TLS session to a PJSIP endpoint with a forged certificate; because verification is bypassed, the connection is accepted and an attacker can intercept or alter the protected media stream, demonstrating a remote exploit that requires no additional privileges.