Coturn up to 4.14.x Mobility Ticket Validation handle_turn_refresh improper authentication

Summaryinfo

A vulnerability was found in Coturn up to 4.14.x. It has been rated as critical. This issue affects the function handle_turn_refresh of the component Mobility Ticket Validation. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-65981. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Coturn up to 4.14.x. Affected by this vulnerability is the function handle_turn_refresh of the component Mobility Ticket Validation. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-65981 since 07/23/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.15.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51651). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Coturn

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14

Website

• Product: https://github.com/coturn/coturn/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion