versatica mediasoup up to 0.22.4/3.20.5 SCTP Stack StateCookie.hpp IsMediasoupStateCookie improper authentication

Summaryinfo

A vulnerability was found in versatica mediasoup up to 0.22.4/3.20.5. It has been classified as critical. This vulnerability affects the function StateCookie::IsMediasoupStateCookie of the file worker/include/RTC/SCTP/association/StateCookie.hpp of the component SCTP Stack. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2026-55663. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in versatica mediasoup up to 0.22.4/3.20.5. This affects the function StateCookie::IsMediasoupStateCookie of the file worker/include/RTC/SCTP/association/StateCookie.hpp of the component SCTP Stack. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-55663 since 06/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.22.5 or 3.20.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• versatica

Name

• mediasoup

Version

• 0.22.0
• 0.22.1
• 0.22.2
• 0.22.3
• 0.22.4
• 3.20.0
• 3.20.1
• 3.20.2
• 3.20.3
• 3.20.4
• 3.20.5

Website

• Product: https://github.com/versatica/mediasoup/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion