Coturn up to 4.15.0 Mobility Handoff ns_turn_server.c mobile_begin_transition improper authentication

Summaryinfo

A vulnerability has been found in Coturn up to 4.15.0 and classified as problematic. Impacted is the function mobile_begin_transition of the file src/server/ns_turn_server.c of the component Mobility Handoff. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-68555. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Coturn up to 4.15.0 and classified as problematic. This issue affects the function mobile_begin_transition of the file src/server/ns_turn_server.c of the component Mobility Handoff. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is availability. The summary by CVE is:

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-68555 since 07/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.16.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Coturn

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15.0

Website

• Product: https://github.com/coturn/coturn/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion