Elixir WebRTC's ex_webrtc library versions before 0.15.1 and between 0.16.0 and 0.16.1 lack proper DTLS peer certificate fingerprint validation in the DTLS client (active) role. This improper certificate validation (CWE-295) removes one side of WebRTC's mutual authentication, weakening the security model. Although this vulnerability alone does not allow media interception in typical deployments, it can be exploited in conjunction with insecure signaling channels or peers with similar flaws to perform a man-in-the-middle attack. The issue is addressed by adding the missing certificate validation in versions 0.15.1 and 0.16.1.

The vulnerability compromises the mutual authentication mechanism of WebRTC by omitting DTLS peer certificate fingerprint validation on the client side. This can facilitate man-in-the-middle attacks when combined with other insecure components such as signaling channels lacking proper security or peers with similar validation weaknesses. Direct exploitation for media interception is not feasible in standard configurations. The CVSS 4.0 score of 8.7 reflects high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

A fix is available in elixir-webrtc versions 0.15.1 and 0.16.1, which restore proper DTLS peer certificate fingerprint validation. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated in the vendor advisory or CVE description.