CVE-2026-21010 – VoIP SIP Digest Authentication Replay

Program Code (Python SIP sim)

# sip_server_sim.py - SIP server that accepts replayed authenticated requests
from flask import Flask, request

app = Flask(__name__)
# Simulated nonce storage: doesn't track used nonces
used_nonces = set()

@app.route('/call', methods=['POST'])
def call():
    auth_header = request.headers.get('Authorization')
    if not auth_header:
        return 'Unauthorized', 401, {'WWW-Authenticate': 'Digest realm="test", nonce="abc123"'}
    # Vulnerability: no replay protection; accepts the same nonce repeatedly
    # In real SIP, a nonce should be used once; here we skip that check.
    return "Call connected"

if __name__ == '__main__':
    app.run(port=5060)

CVE-2026-21010 – VoIP SIP Digest Authentication Replay

Overview

A SIP server implements digest authentication but does not enforce nonce uniqueness or expiration. An attacker can capture a single valid Authorization header and replay it to make unauthorized calls, bypassing authentication.

Vulnerability Details

• Type: Replay Attack
• Impact: Toll fraud, unauthorized call forwarding.
• Root Cause: The server does not track used nonces and accepts the same authentication data multiple times.

Exploit Demonstration

1. Start the SIP server:
   root@kitploit:~

   pip install flask
   python sip_server_sim.py
   

2. Run the exploit:
   root@kitploit:~

   python exploit_sip_replay.py
   

The replayed request succeeds.