CVE-2026-65981 in Coturn
Summary
by MITRE • 08/01/2026
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within the coturn TURN and STUN server implementation, specifically affecting versions prior to 4.15.0. The flaw occurs during the mobility feature handling when a server with --mobility flag enabled processes resumed REFRESH requests. The security issue stems from improper session validation logic that fails to verify the identity of the allocation owner when processing resumption requests. This represents a critical authorization bypass vulnerability that allows authenticated attackers to hijack network traffic and consume resources allocated to legitimate users.
The technical implementation flaw resides in the handle_turn_refresh function within the resume branch logic. When processing a resumed session, the system locates the victim allocation (orig_ss) using only the attacker-controlled mobile id parameter rather than verifying ownership through proper authentication checks. The credential verification mechanism contains a critical logical error where copy_auth_parameters is conditionally executed only when the resuming session is unauthenticated. However, for long-term-credential sessions, the hmackey_set flag remains set to 1 from the attacker's original authentication, causing the system to skip credential copying and validation entirely. This results in check_stun_auth validating the REFRESH request against the attacker's own credentials instead of the legitimate allocation owner's identity.
The operational impact of this vulnerability is severe as it enables attackers to perform session hijacking attacks with significant network resource consumption capabilities. An authenticated attacker who obtains a victim's MOBILITY-TICKET can not only receive and inject relayed traffic but also consume the victim's allocated bandwidth quota, effectively causing denial-of-service conditions for legitimate users. The attack vector requires only that an attacker acquire a valid mobility ticket from a target user, which could occur through various means including session hijacking, credential theft, or social engineering attacks against the victim's authentication mechanisms.
This vulnerability maps directly to CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) within the Common Weakness Enumeration framework. The flaw also aligns with ATT&CK technique T1566 (Phishing) as attackers may need to obtain valid mobility tickets through social engineering, and T1071.004 (Application Layer Protocol: DNS) as TURN/STUN protocols are commonly used for network traffic routing. Additionally, this represents a privilege escalation vulnerability under ATT&CK technique T1548.003 (Sudo and SUID) in terms of resource consumption abuse rather than traditional privilege escalation.
The recommended mitigation strategy involves upgrading to coturn version 4.15.0 or later where the fix properly validates that resuming sessions match the original allocation owner's identity before allowing traffic relay operations. Organizations should also implement additional monitoring for unusual mobility ticket usage patterns and consider deploying rate limiting controls on refresh requests to minimize potential impact from successful exploitation attempts. Network segmentation and proper access controls around TURN/STUN server deployments can help limit the attack surface while maintaining operational security measures against credential theft scenarios that could lead to this vulnerability being exploited.