A logic vulnerability was found in GStreamer's webrtcbin component (gst-plugins-bad). The checksdpcrypto() function in webrtcsdp.c contains an inverted boolean condition at lines 128-134 that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it.

The check reads: if (!ISEMPTYSDPATTRIBUTE(messagefingerprint) && !ISEMPTYSDPATTRIBUTE(mediafingerprint)) Which means: if BOTH fingerprints ARE present, reject. The correct logic should reject when both are ABSENT.

File: subprojects/gst-plugins-bad/ext/webrtc/webrtcsdp.c Function: checksdpcrypto()

An attacker who can intercept and modify the WebRTC signaling channel can remove a=fingerprint attributes from SDP messages. The vulnerable webrtcbin will accept the modified SDP, bypassing the RFC 8122 fingerprint-to-DTLS-certificate binding. This weakens defenses against man-in-the-middle attacks on media streams.

Practical impact is limited: exploitation requires MITM on the signaling channel (typically TLS-protected), and the DTLS layer may still independently validate certificates. This is a defense-in-depth bypass, not a complete cryptographic break.

Affected: GStreamer gst-plugins-bad (reproduced on 1.28.3 and current main) Fixed: Planned for GStreamer 1.28.5 Fix MR: https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/mergerequests/98 Upstream issue: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/workitems/5171 (confidential)

Reporter: Clouditera Security; Z.ai Security; NSFOCUS PSIRT Ticket: PSIRTSUPT-19091