CVE-2026-44700: Ex webrtc Ex_webrtc Client-role Handshake Is Missing Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qwfw-ggxw-577c",
  "modified" : "2026-05-15T23:46:08Z",
  "published" : "2026-05-08T17:08:18Z",
  "aliases" : [ "CVE-2026-44700" ],
  "summary" : "ex_webrtc client-role handshake is missing DTLS peer fingerprint validation",
  "details" : "### Summary\nMissing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps.\n\n### Details\n`ex_webrtc` validates the DTLS peer's certificate fingerprint against the value advertised in the SDP offer/answer when acting as the DTLS server (passive role). When acting as the DTLS client (active role) -- the default when answering a remote offer with `a=setup:actpass`, which is what browsers always send -- the fingerprint check was skipped on the handshake-completion code path that returns no outgoing packets. This is the most common deployment mode (e.g., an SFU or media server answering a browser's offer).\n\nAll released versions prior to 0.15.1 and 0.16.1 are affected. No backports to older lines are planned -- users should upgrade to 0.15.1 or 0.16.1.\n\n### Impact\nThe bug eliminates one half of WebRTC's mutual DTLS authentication. The security of the media and data-channel encryption then rests entirely on the remote peer's fingerprint check.\n\nOn its own, the bug does **not** allow:\n\n- Passive eavesdropping on SRTP media.\n- A network-positioned attacker to intercept media against a standards-compliant browser peer over a TLS-protected signalling channel -- the browser's fingerprint check prevents the second leg of the MITM from succeeding.\n\nThe bug **does** enable a full MITM on media and data channels when combined with any of:\n\n- Insecure signalling (HTTP / plain WebSocket) allowing SDP rewrite in transit.\n- A compromised or malicious signalling server.\n- A peer implementation with a similar fingerprint-validation gap.\n\nBoth audio/video media (SRTP) and data channels (SCTP-over-DTLS) are affected.\n\n### Patches\n- `0.15.1` (for the 0.15.x line)\n- `0.16.1` (for the 0.16.x line)\n\n### Workarounds\nNone. Upgrade is required.\n\n### Resources\n- [Issue](https://github.com/elixir-webrtc/ex_webrtc/issues/249)\n- [PR](https://github.com/elixir-webrtc/ex_webrtc/pull/250)\n- [Release 0.15.1](https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1)\n- [Release 0.16.1](https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Hex",
      "name" : "ex_webrtc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.15.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Hex",
      "name" : "ex_webrtc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.16.0"
      }, {
        "fixed" : "0.16.1"
      } ]
    } ],
    "versions" : [ "0.16.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/security/advisories/GHSA-qwfw-ggxw-577c"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-44700"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/issues/249"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/pull/250"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/commit/658c63221a869fb12bb9989599c3688751b0531b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.15.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/elixir-webrtc/ex_webrtc/releases/tag/v0.16.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-295" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-08T17:08:18Z",
    "nvd_published_at" : "2026-05-14T21:16:47Z"
  }
}