# UNDF: UNDF-2026-000000128
diff --git a/jvb/src/main/kotlin/org/jitsi/videobridge/cc/allocation/BandwidthAllocator.kt b/jvb/src/main/kotlin/org/jitsi/videobridge/cc/allocation/BandwidthAllocator.kt
index 1234567..abcdef0 100644
--- a/jvb/src/main/kotlin/org/jitsi/videobridge/cc/allocation/BandwidthAllocator.kt
+++ b/jvb/src/main/kotlin/org/jitsi/videobridge/cc/allocation/BandwidthAllocator.kt
@@ -215,13 +215,12 @@ class BandwidthAllocator<T : MediaSourceContainer>(
     // On-stage sources are considered selected (with higher priority).
     private val selectedSources: List<String>
         get() {
-            // On-stage sources are considered selected (with higher priority).
-            val selectedSources = allocationSettings.onStageSources.toMutableList()
-            allocationSettings.selectedSources.forEach {
-                if (!selectedSources.contains(it)) {   // O(n) per element — CWE-407
-                    selectedSources.add(it)
-                }
-            }
-            return selectedSources
+            // CWE-407 fix: use LinkedHashSet for O(1) deduplication while preserving insertion order.
+            // onStageSources are higher priority so they go in first.
+            val merged = LinkedHashSet(allocationSettings.onStageSources)
+            merged.addAll(allocationSettings.selectedSources)
+            return merged.toList()
         }