Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-19T20:38:28 coturn: Coturn: Unauthorized actions or resource manipulation via STUN request modification 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CWE-354

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.

A flaw was found in Coturn, a free open source implementation of TURN and STUN (Session Traversal Utilities for NAT) Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows the attacker to modify the request by overriding allocation lifetime, injecting permissions, or bypassing origin checks, potentially leading to unauthorized actions or resource manipulation.

Coturn is not shipped in any Red Hat product. The Fedora and EPEL community builds ship coturn version 4.17.2, which already includes the fix for this issue (fixed in 4.15.0) and are therefore not affected. Upgrade to coturn version 4.15.0 or later. Deployments using TLS or DTLS transports are not vulnerable to this issue. https://www.cve.org/CVERecord?id=CVE-2026-68554 https://nvd.nist.gov/vuln/detail/CVE-2026-68554 https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978 https://github.com/coturn/coturn/releases/tag/4.15.0 https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc