FreeSWITCH’s mod_verto module allowed an attacker to bind a chosen session identifier before authentication. By sending a frame that claimed ownership of a sessid that already belonged to an active connection, the module inserted the new connection into the global session hash and dropped the previous occupant, delivering a verto.punt that detaches the client’s calls and closes the socket. The flaw is effectively an authentication bypass (CWE-287) that permits an unauthenticated network attacker to sever legitimate sessions, causing service disruption.

The vulnerability exists in the FreeSWITCH signaling platform from SignalWire, specifically the mod_verto JSON-RPC handler in all versions released before 1.11.1. Any system running FreeSWITCH without the 1.11.1 or later patch that implements the corrected session binding logic is affected.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires network access to the mod_verto endpoints and knowledge of a valid sessid to trigger the eviction. The exploit can be performed without authentication, making it a straightforward denial-of-service attack on affected hosts.