Executive Summary

CVE-2026-43915 is a stored cross-site scripting (XSS) vulnerability in the Coturn TURN/STUN server's web-admin HTTPS interface. An attacker can exploit this by creating a TURN allocation with a specially crafted USERNAME containing malicious HTML or JavaScript code.

When an authenticated web-admin user views the TURN session list, the injected script executes in their browser. This happens because the username input is not properly validated, sanitized, or HTML encoded before being displayed.

In configurations allowing anonymous TURN access, the vulnerability can be exploited without credentials. In authenticated setups, the attacker needs valid TURN credentials or control over a provisioned username. The issue affects Coturn versions prior to 4.11.0 and has been fixed in version 4.11.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary JavaScript in the context of an authenticated web-admin user's browser. This can lead to unauthorized actions such as session hijacking, theft of sensitive information, or manipulation of the web-admin interface.

The attack requires either anonymous TURN access or valid TURN credentials, meaning the risk depends on the server's configuration and access controls.

The CVSS score of 5.4 indicates a moderate severity, with a network attack vector, low complexity, and requiring user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the TURN allocations for suspicious or crafted USERNAME values containing HTML or JavaScript code. Specifically, inspecting the TURN session list on the web-admin HTTPS interface at the /ps endpoint can reveal injected scripts when viewed by an authenticated web-admin user.

Since the vulnerability involves stored cross-site scripting via the USERNAME field, detection involves checking for unusual or unexpected HTML/JavaScript content in TURN usernames.

No specific commands are provided in the available resources, but general detection steps could include:

• Access the Coturn web-admin interface and review the TURN session list at the /ps endpoint for suspicious USERNAME entries.
• Use network monitoring tools to capture TURN allocation requests and inspect USERNAME fields for injected code.
• If using anonymous TURN access (--no-auth), monitor for unexpected TURN allocations with suspicious USERNAME values.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Coturn to version 4.11.0 or later, where this stored cross-site scripting vulnerability has been fixed.

Additional immediate steps include:

• Avoid using anonymous TURN access (--no-auth) configurations, as these may allow exploitation without credentials.
• Restrict access to the web-admin HTTPS interface to trusted users only.
• Monitor and validate TURN allocations to detect and block suspicious USERNAME values.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in Coturn affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0