Security Flaw in Coturn TURN and STUN Server by Coturn

CVE-2026-68554

What is CVE-2026-68554?

Coturn is a widely-used open-source implementation of TURN and STUN servers. Prior to version 4.15.0, it was vulnerable to an on-path attack, where malicious actors could manipulate the STUN request's attributes after the MESSAGE-INTEGRITY field. This manipulation enabled attackers to adjust the STUN header length and recompute the unkeyed FINGERPRINT, leading to potential overrides of allocation settings or permissions. The parsing routines in the server-side code did not sufficiently restrict processing beyond the MESSAGE-INTEGRITY header, which allowed for the injection of unauthorized attributes. It is crucial to upgrade to version 4.15.0 or higher, where this vulnerability has been addressed, particularly for deployments using UDP or TCP. Note that TLS and DTLS implementations provide protection against these forms of modification in transit.

References