CVE-2026-55663
Received Received - Intake

State Cookie Spoofing in Mediasoup SCTP Stack

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55663
EUVD
EUVD-2026-65694

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
versatica mediasoup to 3.20.5 (inc)
versatica mediasoup to 0.22.4 (inc)
mediasoup mediasoup From 3.20.0 (inc) to 3.20.6 (inc)
mediasoup mediasoup From 0.22.0 (inc) to 0.22.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects mediasoup's built-in SCTP stack in versions 3.20.0 to 3.20.5 (npm) and 0.22.0 to 0.22.4 (Rust). It involves improper authentication of state cookies using hardcoded magic values instead of per-instance secrets and HMAC, violating RFC 9260. This allows on-path attackers to forge COOKIE-ECHO messages, bypass validation, and establish unauthorized SCTP associations, enabling DataChannel message injection.

Detection Guidance

Detecting this vulnerability requires checking if your mediasoup version is affected (npm 3.20.0-3.20.5 or Rust 0.22.0-0.22.4) and monitoring for unauthorized SCTP associations. Inspect logs for PlainTransport or PipeTransport with SCTP enabled and no DTLS protection. Look for unexpected COOKIE-ECHO chunks or DataChannel messages from untrusted sources.

Impact Analysis

An attacker could intercept and manipulate SCTP traffic, inject malicious DataChannel messages, or establish unauthorized connections. This could lead to data breaches, unauthorized access to sessions, or disruption of services if PlainTransport or PipeTransport with SCTP enabled is used without DTLS protection.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to insufficient protection of sensitive data transmitted via SCTP.

Mitigation Strategies

Upgrade to mediasoup npm version 3.20.6+ or Rust crate 0.22.5+. Disable SCTP on PlainTransport/PipeTransport if unused. Enable DTLS protection for all transports. Monitor network traffic for suspicious SCTP activity and block unauthorized UDP ports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart