CVE-2026-49843 describes an improper authentication vulnerability (CWE-287) in FreeSWITCH's mod_verto JSON-RPC handler prior to version 1.11.1. The handler binds the connection to the client-supplied session ID on the first frame before authentication occurs. This binding inserts the connection into a global session hash, and if a key collision occurs, the previous occupant is dropped, its calls detached, and its socket closed. An unauthenticated network attacker who knows a valid session UUID can exploit this to evict legitimate clients, causing denial of service. The vulnerability is patched in FreeSWITCH version 1.11.1.

The vulnerability allows an unauthenticated attacker to forcibly disconnect legitimate clients by evicting their sessions if the attacker knows the session UUID. This results in denial of service (availability impact) but does not affect confidentiality or integrity. The CVSS 3.1 base score is 5.3 (medium severity) reflecting network attack vector, no privileges required, no user interaction, and impact limited to availability.

Upgrade FreeSWITCH to version 1.11.1 or later, where this vulnerability is patched. There is no indication of alternative mitigations or temporary fixes. Patch status is not explicitly stated but the vendor has fixed the issue in 1.11.1, so upgrading is the recommended remediation.