What is CVE-2026-44700?

CVE-2026-44700 is a high-severity security vulnerability in ex_webrtc (erlang), affecting versions < 0.15.1. It is fixed in 0.15.1, 0.16.1.

Which versions of ex_webrtc are affected by CVE-2026-44700?

ex_webrtc (erlang) versions < 0.15.1 is affected.

Is there a fix for CVE-2026-44700?

Yes. CVE-2026-44700 is fixed in 0.15.1, 0.16.1. Upgrade to this version or later.

Is CVE-2026-44700 exploitable, and should I be worried?

Whether CVE-2026-44700 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-44700 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-44700?

Upgrade: ex_webrtc to 0.15.1 or later, ex_webrtc to 0.16.1 or later.

CVE-2026-44700 in ex_webrtc

Q: Which versions of ex_webrtc are affected by CVE-2026-44700?

ex_webrtc (erlang) versions < 0.15.1 is affected.

Q: Is there a fix for CVE-2026-44700?

Yes. CVE-2026-44700 is fixed in 0.15.1, 0.16.1. Upgrade to this version or later.

Q: Is CVE-2026-44700 exploitable, and should I be worried?

Whether CVE-2026-44700 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-44700 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-44700?

Upgrade: ex_webrtc to 0.15.1 or later, ex_webrtc to 0.16.1 or later.

Summary

ex_webrtc client-role handshake is missing DTLS peer fingerprint validation

Missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps.

Details

ex_webrtc validates the DTLS peer's certificate fingerprint against the value advertised in the SDP offer/answer when acting as the DTLS server (passive role). When acting as the DTLS client (active role) -- the default when answering a remote offer with a=setup:actpass, which is what browsers always send -- the fingerprint check was skipped on the handshake-completion code path that returns no outgoing packets. This is the most common deployment mode (e.g., an SFU or media server answering a browser's offer).

All released versions prior to 0.15.1 and 0.16.1 are affected. No backports to older lines are planned -- users should upgrade to 0.15.1 or 0.16.1.

Workarounds

None. Upgrade is required.

Resources

Impact

The bug eliminates one half of WebRTC's mutual DTLS authentication. The security of the media and data-channel encryption then rests entirely on the remote peer's fingerprint check.

On its own, the bug does not allow:

Passive eavesdropping on SRTP media.
A network-positioned attacker to intercept media against a standards-compliant browser peer over a TLS-protected signalling channel -- the browser's fingerprint check prevents the second leg of the MITM from succeeding.

The bug does enable a full MITM on media and data channels when combined with any of:

Insecure signalling (HTTP / plain WebSocket) allowing SDP rewrite in transit.
A compromised or malicious signalling server.
A peer implementation with a similar fingerprint-validation gap.

Both audio/video media (SRTP) and data channels (SCTP-over-DTLS) are affected.

Affected versions

ex_webrtc (< 0.15.1) ex_webrtc (= 0.16.0)

Security releases

ex_webrtc → 0.15.1 (erlang) ex_webrtc → 0.16.1 (erlang)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

0.15.1 (for the 0.15.x line)
0.16.1 (for the 0.16.x line)

Frequently Asked Questions

What is CVE-2026-44700? CVE-2026-44700 is a high-severity security vulnerability in ex_webrtc (erlang), affecting versions < 0.15.1. It is fixed in 0.15.1, 0.16.1.
Which versions of ex_webrtc are affected by CVE-2026-44700? ex_webrtc (erlang) versions < 0.15.1 is affected.
Is there a fix for CVE-2026-44700? Yes. CVE-2026-44700 is fixed in 0.15.1, 0.16.1. Upgrade to this version or later.
Is CVE-2026-44700 exploitable, and should I be worried? Whether CVE-2026-44700 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-44700 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-44700?
- Upgrade ex_webrtc to 0.15.1 or later
- Upgrade ex_webrtc to 0.16.1 or later