A flaw in FreeSWITCH’s mod_verto component allows an unauthenticated user to send arbitrary userVariables over a WebSocket connection before authentication is verified. The variables are written into the connection state before the supplied password is checked, and the connection remains open even if the password comparison fails. As a result, values set during a failed login attempt persist on the same WebSocket and are carried forward into a later successful login on that same connection. This persistence can lead to unauthorized manipulation of configuration or session state for a subsequently authenticated user.

SignalWire’s FreeSWITCH product, specifically the mod_verto module in all releases earlier than version 1.11.1. Applications that rely on WebSocket sessions provided by mod_verto and that perform authentication checks after setting userVariables are susceptible.

Risk and exploitability: The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at present. An attacker who can establish an unauthenticated WebSocket connection to mod_verto may inject userVariables before authentication and, because the connection remains open after a failed password comparison, those variables persist across a subsequent successful login on the same session. This persistence can influence the authenticated session’s state. The vulnerability is mitigated only by applying the published patch.