CVE-2026-65981
Description
A flaw was found in Coturn, an open-source implementation of TURN and STUN servers. An authenticated attacker who obtains a victim's MOBILITY-TICKET can exploit this vulnerability during a session resume. This allows the attacker to take over the victim's TURN (Traversal Using Relays around NAT) allocation. As a result, the attacker can receive and inject relayed network traffic, and consume the victim's allocated resources.
Statement
This flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. Fedora and EPEL currently ship coturn 4.16.0, which already includes the fix released in 4.15.0, so the shipped builds are not vulnerable.
Mitigation
No action needed - the shipped coturn build (4.16.0) already contains the upstream fix.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
