Stored XSS Vulnerability in Coturn's Web-Admin Interface by Coturn Project

CVE-2026-43915

What is CVE-2026-43915?

Coturn, an open-source implementation of TURN and STUN servers, contains a stored cross-site scripting (XSS) vulnerability in the web-admin interface for versions prior to 4.11.0. This vulnerability allows an attacker to inject malicious HTML or JavaScript through a crafted USERNAME value in TURN allocations. When an authenticated user views the TURN session list, the injected code executes, potentially compromising secure information. In scenarios where anonymous access is enabled, exploitation may occur without requiring TURN credentials. For authenticated setups, valid TURN credentials or control over a registered username is necessary for exploitation. This vulnerability highlights the importance of keeping Coturn updated to mitigate such risks.

References