CVE-2026-65981

Received Received - Intake

Authentication Bypass in Coturn Server

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-65981

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	4.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Coturn is a free open source implementation of TURN and STUN Server. Prior to version 4.15.0, a server using the --mobility option has a flaw where a resumed REFRESH request is authenticated with the attacker's credentials but not verified against the original allocation owner. This allows an authenticated attacker who has a victim's MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota.

Detection Guidance

Detection requires checking Coturn server version and analyzing network traffic for unauthorized REFRESH requests. Verify if your Coturn version is below 4.15.0. Monitor for unusual relayed traffic patterns or quota consumption spikes from authenticated sessions.

Impact Analysis

An attacker could intercept, modify, or inject relayed traffic meant for the victim. They could also consume the victim's allocated bandwidth quota, potentially disrupting legitimate services or communications.

Compliance Impact

This vulnerability could lead to unauthorized access to relayed traffic and quota consumption, potentially violating data confidentiality and integrity requirements under GDPR and HIPAA. Unauthorized access to relayed traffic may expose sensitive data, while quota consumption could disrupt critical services, both of which are compliance risks.

Mitigation Strategies

Upgrade Coturn to version 4.15.0 or later to address the vulnerability. Ensure all instances of Coturn are updated to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-65981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70