CVE-2026-41470 describes an authorization bypass vulnerability in Live Networks, Inc.'s LIVE555 RTSP server prior to version 2026.04.22. The vulnerability arises because the server accepts replayed valid Session tokens from unauthenticated connections, allowing attackers to issue RTSP PLAY and TEARDOWN commands on a second TCP connection without proper authentication. This can lead to server crashes caused by virtual function call errors or disruption of active streaming sessions by forcibly terminating victim sessions. The CVSS 4.0 base score is 8.2, indicating high severity. No official patch or remediation level has been disclosed by the vendor as of the published date.

Attackers who obtain a valid Session token can bypass authorization controls to send RTSP commands that disrupt service. This can result in denial of service through server crashes or interruption of legitimate streaming sessions. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to RTSP services to trusted networks or implementing network-level controls to prevent unauthorized replay of Session tokens. Monitor for unusual RTSP command activity that could indicate exploitation attempts.