CVE-2026-65981

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-65981

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65981.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-65981

Aliases

GHSA-69wx-x7x6-pjj8

Downstream

DEBIAN-CVE-2026-65981

UBUNTU-CVE-2026-65981

Published

2026-07-31T21:00:02.893Z

Modified

2026-08-07T11:50:48.675797828Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

Details

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handleturnrefresh resume branch, the victim allocation (origss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copyauthparameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackeyset set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and checkstunauth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65981.json",
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Affected packages

Git / github.com/coturn/coturn

Affected ranges

Type

GIT

Repo

https://github.com/coturn/coturn

Events

Introduced

Fixed

37df0513168f830a7c9ce0a411db0300fa182f05

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.15.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.10.0

4.11.0

4.12.0

4.13.0

4.13.1

4.14.0

4.4.5.3

4.4.5.4

4.5.0.1

4.5.0.2

4.5.0.3

4.5.0.4

4.5.0.5

4.5.0.6

4.5.0.7

4.5.1.0

4.5.1.1

4.5.1.2

4.5.1.3

4.5.2

4.6.0

4.6.2

4.6.3

4.7.0

4.8.0

4.9.0

docker/4.*

docker/4.10.0-r0

docker/4.10.0-r1

docker/4.11.0-r0

docker/4.12.0-r0

docker/4.13.0-r0

docker/4.13.1-r0

docker/4.14.0-r0

docker/4.5.2-r0

docker/4.5.2-r10

docker/4.5.2-r11

docker/4.5.2-r12

docker/4.5.2-r13

docker/4.5.2-r14

docker/4.5.2-r6

docker/4.5.2-r7

docker/4.5.2-r8

docker/4.5.2-r9

docker/4.6.0-r0

docker/4.6.0-r1

docker/4.6.1-r0

docker/4.6.1-r1

docker/4.6.1-r2

docker/4.6.1-r3

docker/4.6.2-r0

docker/4.6.2-r1

docker/4.6.2-r10

docker/4.6.2-r11

docker/4.6.2-r12

docker/4.6.2-r13

docker/4.6.2-r2

docker/4.6.2-r3

docker/4.6.2-r4

docker/4.6.2-r5

docker/4.6.2-r6

docker/4.6.2-r7

docker/4.6.2-r8

docker/4.6.2-r9

docker/4.6.3-r0

docker/4.6.3-r1

docker/4.6.3-r2

docker/4.6.3-r3

docker/4.7.0-r0

docker/4.7.0-r1

docker/4.7.0-r2

docker/4.7.0-r3

docker/4.7.0-r4

docker/4.8.0-r0

docker/4.8.0-r1

docker/4.9.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65981.json"