CVE-2026-68554

Received Received - Intake

Authentication Bypass in Coturn STUN/TURN Server

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-68554

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	4.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-924	The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

CVE-2026-68554 is a vulnerability in Coturn, a free open source implementation of TURN and STUN Server. Prior to version 4.15.0, an attacker can modify authenticated STUN requests by appending attributes after MESSAGE-INTEGRITY, altering the STUN header length, and recalculating the FINGERPRINT. This allows the original HMAC to remain valid while enabling the attacker to override allocation lifetime, inject permissions, or bypass origin checks.

Detection Guidance

Detecting this vulnerability requires checking for Coturn server versions prior to 4.15.0 and monitoring for unusual STUN request modifications. Inspect server logs for malformed STUN packets or unexpected attribute sequences. Use network tools like Wireshark to capture and analyze STUN traffic for trailing attributes after MESSAGE-INTEGRITY. Verify server version with commands like 'turnserver --version' and update if below 4.15.0.

Impact Analysis

An attacker could exploit this to manipulate STUN requests, potentially gaining unauthorized access to network resources, altering permissions, or bypassing security checks. This could lead to data breaches, unauthorized access to services, or disruption of network operations.

Compliance Impact

This vulnerability allows an on-path attacker to modify STUN requests by appending attributes after MESSAGE-INTEGRITY, potentially altering allocation lifetimes or injecting permissions. This could lead to unauthorized access or data exposure, which may violate compliance requirements for data protection standards like GDPR or HIPAA that mandate integrity and confidentiality of communications.

Mitigation Strategies

Upgrade Coturn to version 4.15.0 or later to address the vulnerability. Ensure TLS or DTLS is enabled for STUN/TURN traffic to prevent in-transit modifications.

Hi! I’m here to help you understand CVE-2026-68554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70