CVE-2026-55663
- Source
- https://cve.org/CVERecord?id=CVE-2026-55663
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55663.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55663
- Aliases
- Published
- 2026-08-25T18:15:16.059Z
- Modified
- 2026-08-27T19:14:09.385792Z
- Severity
-
- 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
- Details
-
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-345" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55663.json" }- References
-
- https://github.com/versatica/mediasoup/releases/tag/3.20.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55663.json
- https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq
- https://nvd.nist.gov/vuln/detail/CVE-2026-55663
- https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7
- https://github.com/versatica/mediasoup/pull/1829
Affected packages
Git / github.com/versatica/mediasoup
Affected versions
3.*
3.20.0
3.20.1
3.20.2
3.20.3
3.20.4
3.20.5
rust-0.*
rust-0.22.0
rust-0.22.1
rust-0.22.2
rust-0.22.3
rust-0.22.4
Database specific
vanir_signatures_modified
"2026-08-27T19:14:09Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55663.json"
vanir_signatures
[
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/PlainTransport.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"98829289175053880522771808341491635189",
"334976016263829255909200647184232116947",
"259194469581646155334019087138409591016",
"124932897891561206029853231498428581039"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-01258563"
},
{
"deprecated": false,
"target": {
"function": "StateCookie::Dump",
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 830.0,
"function_hash": "36913893796356766402693352956679699750"
},
"signature_version": "v1",
"id": "CVE-2026-55663-0bc7c584"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/SCTP/public/SctpOptions.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"112847289043841237084953971114131432823",
"25907530483282869698494742976576508744",
"317833580826811032142866418293599515205",
"35091263053218896231672884454170038361"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-0cda3bdb"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/PipeTransport.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"70527139793525657354795696423275329266",
"121206284009123228012707684711677570373",
"53950395188613287085513046525403350945",
"124932897891561206029853231498428581039"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-14b899f0"
},
{
"deprecated": false,
"target": {
"file": "worker/include/RTC/SCTP/packet/parameters/StateCookieParameter.hpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"144148943044528390679563293280207934627",
"226715123979774486126488756320861062569",
"315279827824524581840716257489830541876",
"316637934413157018256342356962512689034"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-20c41dd5"
},
{
"deprecated": false,
"target": {
"function": "PipeTransport::PipeTransport",
"file": "worker/src/RTC/PipeTransport.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 3123.0,
"function_hash": "194840865972559677020801961199246750146"
},
"signature_version": "v1",
"id": "CVE-2026-55663-2e6be999"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/SCTP/association/Association.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"80138330122675069543991385756521971720",
"214002479522661428745562492447780756189",
"100897909588273043187583439665712365744",
"34491774435410228986169499037182694527",
"50874548559911680047507215939453175529",
"322674495673712208693649190142452832874",
"72377880176160906851734856077218835366",
"243290353588300788489850649027216236892",
"261391538999051189613199881843865915514",
"132654145478627593028204124339836556000",
"251447600124597579411596781948366662540",
"245707183663902088739976905818487914187",
"266384026559738818198496760374565151936",
"310729916360225316020297934501241303013",
"320948377172598679151610117320235034325",
"236685423649459555422383393952466945312",
"265641455067162974504018074774238188498",
"265693703299499021152600781479019557092",
"129953080658321932766144898599117209318",
"722516308522786207614478922285175120",
"34318065547961251546658787237335697304",
"99845376601932747060164225574077426490",
"317397307415496810597615667686084646192",
"109974962076194963740594012646853737867",
"221609708672108802212468395213526393580",
"16701412424673186517361435035468502097",
"22495760874321688071093347849531752388",
"156904682225593214729739430360708286758"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-312aa215"
},
{
"deprecated": false,
"target": {
"file": "worker/test/src/RTC/SCTP/association/TestAssociation.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"128622045745471573208711847318810573691",
"326982480226818781290613600412383657486",
"166325697506176218596577962519796477908",
"283711264008964776731896291366943096226"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-3e821e7d"
},
{
"deprecated": false,
"target": {
"function": "Association::HandleReceivedCookieEchoChunk",
"file": "worker/src/RTC/SCTP/association/Association.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 1987.0,
"function_hash": "171932139782073914344294739240892738109"
},
"signature_version": "v1",
"id": "CVE-2026-55663-3f3c9920"
},
{
"deprecated": false,
"target": {
"function": "SctpOptions::Dump",
"file": "worker/src/RTC/SCTP/public/SctpOptions.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 3529.0,
"function_hash": "143814765769549418678837473701664715671"
},
"signature_version": "v1",
"id": "CVE-2026-55663-4763d56b"
},
{
"deprecated": false,
"target": {
"function": "StateCookieParameter::WriteStateCookieInPlace",
"file": "worker/src/RTC/SCTP/packet/parameters/StateCookieParameter.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 420.0,
"function_hash": "325232548603709048077414778970572997797"
},
"signature_version": "v1",
"id": "CVE-2026-55663-4e4e8a08"
},
{
"deprecated": false,
"target": {
"file": "worker/include/RTC/Transport.hpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"48831292524149000834347942168696809786",
"236606325253955808530684522502620951001",
"271151562036079973257978567560047565642",
"192438749129613196868706352692945389611"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-5a1aa299"
},
{
"deprecated": false,
"target": {
"file": "worker/test/src/RTC/SCTP/association/TestStateCookie.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"327643466768994391230289605294502051916",
"276401892611270552976332018100318136060"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-62bf0d25"
},
{
"deprecated": false,
"target": {
"function": "StateCookie::IsMediasoupStateCookie",
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 549.0,
"function_hash": "322484769447792097568305042291256198593"
},
"signature_version": "v1",
"id": "CVE-2026-55663-6318c0ed"
},
{
"deprecated": false,
"target": {
"function": "StateCookie::Write",
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 1395.0,
"function_hash": "52258147652522457501472968674383536688"
},
"signature_version": "v1",
"id": "CVE-2026-55663-64f1da6b"
},
{
"deprecated": false,
"target": {
"function": "Association::HandleReceivedInitChunk",
"file": "worker/src/RTC/SCTP/association/Association.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 3691.0,
"function_hash": "69246857365079760973454701082573234940"
},
"signature_version": "v1",
"id": "CVE-2026-55663-652d3d9f"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/WebRtcTransport.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"180614762125227337943530616290738473646",
"73957687795482132904459938900300507603",
"213143239524597867418097717481641092056",
"24532689432168253955367009466006558032",
"74617752671763956373249847562222192816",
"215479042768502050699535447718317215197",
"226486236725297346071420305852913283148",
"93897817500326877153669619875734636821"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-6b0f10fd"
},
{
"deprecated": false,
"target": {
"function": "mayConnectOnReceivedSctpData",
"file": "worker/src/RTC/SCTP/association/Association.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 34.0,
"function_hash": "203184049052890519177121071560936904196"
},
"signature_version": "v1",
"id": "CVE-2026-55663-8369f2e4"
},
{
"deprecated": false,
"target": {
"file": "worker/include/RTC/SCTP/association/Association.hpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"298696620288709179067999906101689177852",
"5374148735990910301082394932960055499",
"44318596308086390203940260126188208981",
"197790315735746973523880853761260372735",
"277346844753094331996208216027093314804",
"18338153822195152405890438695104356035",
"152635144653391412819797495124330326067",
"55272184527750106183522775412722498901",
"39260383386756418403232578242316672010",
"30693982114971115596857671876103663314"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-866421d9"
},
{
"deprecated": false,
"target": {
"function": "Transport::Transport",
"file": "worker/src/RTC/Transport.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 1621.0,
"function_hash": "298471806104954547463587955353964839027"
},
"signature_version": "v1",
"id": "CVE-2026-55663-872cdc2f"
},
{
"deprecated": false,
"target": {
"function": "PlainTransport::PlainTransport",
"file": "worker/src/RTC/PlainTransport.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 6011.0,
"function_hash": "216279430732963865860992275319343500847"
},
"signature_version": "v1",
"id": "CVE-2026-55663-99095d6d"
},
{
"deprecated": false,
"target": {
"file": "worker/include/RTC/SCTP/association/StateCookie.hpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"85523180289611850088267335638899549956",
"309314890151852222112607039015754968664",
"127900175582463845242544808632756363946",
"73228062454903964411557049909870360636",
"2177215429275001984251348844217196903",
"177631243396967222808080704679614404628",
"190260815990355577969480155866269502873",
"209609498175558013105551809994688939275",
"30788378541876570748285061083675468918",
"294901410443700574702924698168062857280",
"306492346219772008700090335599706526159",
"24086839850845356292820946169086629165",
"169997491127493822814641696496762571164",
"174228159289108680701866301576397495021",
"161722975046834455107334763484743724799",
"23802477308186182952441013759848035194",
"300333481262432509515738963823703648964",
"144148943044528390679563293280207934627",
"143350946554431351770337253189992122545",
"250025753775270635764038954924827970627",
"148179200312450942516650325740203364834",
"144148943044528390679563293280207934627",
"61534630705491936378664674691000618396",
"183620880437442019308730128224929890220",
"200941489910554658060699049165771765053",
"284944097214751718461458423725419237657",
"51993580092398363820413650849507769846",
"170151454500349692951435041803984159865"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-a0d9b947"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/SCTP/packet/parameters/StateCookieParameter.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"214282456308859023245181039588263970623",
"43743963867328907768564625049796960260",
"204297911010607992010093995014637822090",
"12102770647400078498063449900176198354",
"180209813135484241889823890465652311205",
"328979770951463544286230039969017322333",
"108146574490390325823407252571968694872",
"233639335933483049107295098386876240410",
"191720414582331887658069347186549152880"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-aa62e3df"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/Transport.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"235507674878531880494353677531813878710",
"162380995845586926257843871434418565296",
"19754437981740536465050154861052501430",
"69938891766850841954374491893756867106",
"249266053980434263965303436532065467106",
"233035695748896301647317383471311635610",
"87018261913833588477720870835155773484",
"324896556114378842159562530982150375455"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-b2ee474c"
},
{
"deprecated": false,
"target": {
"function": "DirectTransport::DirectTransport",
"file": "worker/src/RTC/DirectTransport.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 312.0,
"function_hash": "276764652198849391107314179178275346372"
},
"signature_version": "v1",
"id": "CVE-2026-55663-ba7c8532"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"178546703349014699725833211760002889638",
"189166129541791378723613378392844665866",
"304334683564783123225110228418994509974",
"45742374312019763630175881343598539487",
"152632603663456919084798972154438058763",
"172852967710306041393427921266864446355",
"262399495219319225050346645843502333418",
"78144914808564054988249505287888139618",
"224954304772437288267674735166345888367",
"220333672174510134597657551115730729032",
"243011536544168938542166048019127243741",
"318410902617915606683319936367861426869",
"222085048984831555089474955261975683597",
"212189121607579818999722952330063362601",
"10486370331734168425973662751643998755",
"316984613796024307747503623029366015766",
"336840724367405732056415593746226522601",
"126335771523772882831306867037967340920",
"216930972780106523590464766069995189350",
"281043452080619496591705729950571812735",
"109518212618659957029567575657392337688",
"105135349804760838859480469610730392589",
"246304193157919982296840929719933147639",
"122312092974972534731479797955931478633",
"25405441966234640313753631079011021659",
"214282456308859023245181039588263970623",
"43743963867328907768564625049796960260",
"204297911010607992010093995014637822090",
"127337292132834769140992045988851764133",
"180209813135484241889823890465652311205",
"209904659914503657066493470716791298722",
"254141052412587745616109970533213684094",
"248240771697591637247197697860284835110",
"89707116188411616303965006876070926030",
"214282456308859023245181039588263970623",
"43743963867328907768564625049796960260",
"204297911010607992010093995014637822090",
"286033949949690121535009199828004729933",
"287362746961954089901455857638266626765",
"81562474929016516127114706250881899921",
"263652038884653636656026585668212271847",
"141675542555219579262931526742329275015",
"237479563251325538155521293302415856818",
"64751216760251777823531098880048958230",
"287308481128705013463555576469809372710",
"241683949475448160905329252534671256923",
"107352710725565717323699341966628901435",
"64694386785654866263949818940638409005",
"67264459415396206370676306910666643435",
"163759393996033377356532670786968583265",
"275991335571254095914800848519272761754",
"259858924582743525877301678406209019353",
"96675361989865051514256759039714501462"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-c2ebc7fb"
},
{
"deprecated": false,
"target": {
"file": "worker/include/RTC/SCTP/public/SctpOptions.hpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"265653477299632691356590846121168079656",
"181675777011482717341858558628896241137",
"115781947805955401093924268884870403189"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-c5075074"
},
{
"deprecated": false,
"target": {
"file": "worker/src/RTC/DirectTransport.cpp"
},
"signature_type": "Line",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"line_hashes": [
"168668416755001519147743633685560489977",
"73364499294950854851738943392813807092",
"55808408862481041101167640754683689226",
"254788992628144924887012615092220451177"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2026-55663-ccd7efda"
},
{
"deprecated": false,
"target": {
"function": "StateCookie::StateCookie",
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 158.0,
"function_hash": "216892858298529286604396052144773577788"
},
"signature_version": "v1",
"id": "CVE-2026-55663-e05cdc04"
},
{
"deprecated": false,
"target": {
"function": "WebRtcTransport::WebRtcTransport",
"file": "worker/src/RTC/WebRtcTransport.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 4356.0,
"function_hash": "56711877302816852154922322227063975078"
},
"signature_version": "v1",
"id": "CVE-2026-55663-e46e97d9"
},
{
"deprecated": false,
"target": {
"function": "StateCookie::Factory",
"file": "worker/src/RTC/SCTP/association/StateCookie.cpp"
},
"signature_type": "Function",
"source": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7",
"digest": {
"length": 330.0,
"function_hash": "198933588751313726210980872167530645928"
},
"signature_version": "v1",
"id": "CVE-2026-55663-f8cb672f"
}
]