By vendor

Coturn_project vulnerabilities

Known CVEs affecting Coturn_project products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-43994HIGH 8.1

  Coturn, a widely-used open source TURN/STUN server for WebRTC applications, contains a critical stack buffer overflow vulnerability in its OAuth token handling code. When Coturn is configured with the --oauth mode (commonly recommended for security), it fails to validate the length of a nonce field embedded in OAuth tokens before copying data into a fixed 256-byte buffer. An attacker can send a specially crafted token that triggers an overflow, potentially writing over 700 bytes of malicious data onto the stack. Notably, the attacker does not need valid OAuth credentials—the overflow happens before any cryptographic verification occurs. This could allow attackers to crash the server or potentially execute arbitrary code, depending on system protections. The vulnerability affects all versions prior to 4.10.0.

• CVE-2026-43915MEDIUM 5.4

  Coturn, an open-source TURN/STUN server implementation, contains a stored cross-site scripting (XSS) flaw in its web administration interface. An attacker can inject malicious HTML or JavaScript through a crafted username when creating a TURN allocation. When an authenticated administrator views the session list, the injected code executes in their browser, potentially allowing session hijacking, credential theft, or administrative takeover. The vulnerability is particularly concerning in deployments using anonymous access mode, where no TURN credentials are required for exploitation. Version 4.11.0 and later resolve this issue.