A logic error in the _check_sdp_crypto() function of GStreamer's webrtcbin component causes an inverted boolean condition. This results in acceptance of SDP offers or answers lacking the mandatory a=fingerprint attribute, while rejecting those that correctly include it. Consequently, an attacker capable of intercepting and modifying WebRTC signaling messages could exploit this to bypass the DTLS certificate fingerprint binding at the SDP level. This weakens defenses against man-in-the-middle attacks on media streams in Red Hat Enterprise Linux 10. The vulnerability is assigned CVE-2026-14935 with a CVSS v3.1 base score of 3.7 (low severity). There is no vendor advisory indication of an available patch or fix at this time.

The vulnerability allows bypassing the SDP-level DTLS certificate fingerprint binding in WebRTC signaling, which weakens the security against man-in-the-middle attacks on media streams. However, the CVSS score of 3.7 indicates the impact is limited, with no confidentiality or availability impact, and requires high attack complexity without privileges or user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14935 for current remediation guidance. Until a fix is available, consider restricting network access to WebRTC signaling channels or employing additional network-level protections to mitigate interception risks. No official fix or temporary workaround is currently documented by the vendor.