CVE-2026-65981
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Coturn versions before 4.15.0 with --mobility enabled contain a vulnerability that allows an authenticated attacker to hijack another user's REFRESH session. An attacker who obtains a victim's MOBILITY-TICKET can receive and inject relayed traffic and consume the victim's quota. The issue is due to incorrect identity verification in the resume branch.
Risk Assessment
An attacker can impersonate another user, intercept their TURN traffic, and consume their resources. This could lead to data confidentiality breaches and service disruption for legitimate users.
Recommendation
Update Coturn to version 4.15.0 or later. If an update is not possible, disable the --mobility option or restrict server access to trusted clients only.
Other vulnerabilities in Coturn
See all- CVE-2026-68555Medium
Coturn version 4.15.0 has a vulnerability that allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing a handoff when --mobility is enabled. This leads to unbounded server-side sessions and process memory exhaustion even with --user-quota=1 configured.
- CVE-2026-68554Low
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.
- CVE-2026-68553High
In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.
- CVE-2026-68552Medium
Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.
- CVE-2026-73216Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.
- CVE-2026-73215High
Coturn before version 4.17.0 has a vulnerability in turnports_allocate_even() that marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508.
- CVE-2026-73214High
Coturn before version 4.16.0 has a vulnerability in dtls_server_input_handler() and create_new_connected_udp_socket() that retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation. An unauthenticated remote sender can exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing.
- CVE-2026-73213Medium
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
- CVE-2026-73212Medium
Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.
- CVE-2026-62959High
Coturn from 4.5.2 through 4.14.0, when started with --acme-redirect and a plaintext-TCP listener, allows an unauthenticated client to send an HTTP GET request and receive a 301 response leaking up to ~870 bytes of adjacent process heap memory. The leaked region may contain other clients' TURN credentials, OAuth tokens, or relayed payloads.
Original NVD description (English source)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.