CVE-2026-44700 Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake
Missing DTLS fingerprint validation in the Elixir WebRTC library allows man-in-the-middle attacks when combined with insecure signaling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44700?
CVE-2026-44700 is a high-severity vulnerability in elixir-webrtc ex_webrtc, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.
Weakness: CWE-295
Which versions are affected by CVE-2026-44700?
4 open source packages ship an affected version, including ex_webrtc.
| Package | Affected | Fixed in |
|---|---|---|
ex_webrtc Hex | All versions | 0.15.1 |
ex_webrtc Hex | All versions | 0.15.1 |
ex_webrtc Hex | From 0.16.0 | 0.16.1 |
ex_webrtc Hex | From 0.16.0 | 0.16.1 |
How do I fix CVE-2026-44700?
Upgrade ex_webrtc to a fixed version for your release line: 0.15.1 or 0.16.1.
Is CVE-2026-44700 being exploited?
There is no known exploitation of CVE-2026-44700 in the wild and no public exploit code.
Sources
Also known as GHSA-qwfw-ggxw-577c.