SQL Injection Vulnerability in Coturn's HTTPS Admin Panel

CVE-2026-53448

What is CVE-2026-53448?

The Coturn TURN and STUN server implementation reveals an SQL injection vulnerability due to improper handling of HTTP query parameters in its admin panel. Specifically, the software fails to sanitize user inputs for operations like delete-user, delete-secret, and delete-IP. This oversight allows an authenticated admin to execute arbitrary SQL commands through affected parameters, potentially leading to complete database control and OS-level access through PostgreSQL. End-users are advised to upgrade to version 4.12.0 or later to mitigate this risk.

References