Random Number Generation Flaw in coturn TURN and STUN Server

CVE-2025-69217

What is CVE-2025-69217?

This vulnerability in coturn involves improper random number generation that compromises the security of nonce creation and port randomization. Affected versions fail to utilize a secure random function, relying on libc's random() instead of the more secure openssl's RAND_bytes. This results in the potential for attackers to predict nonces and port allocations through a series of unauthenticated allocation requests, enabling unauthorized access while potentially spoofing IP addresses in environments like IoT. A patch addressing this issue is available in commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9.

References