CVE-2026-43915: Coturn Stored XSS in Web-Admin Interface (4.11.0 Fix)

Technical summary

The vulnerability is a stored (persistent) XSS issue in Coturn versions before 4.11.0, classified as CWE-79. The root cause is insufficient input validation on the USERNAME parameter during TURN allocation creation. Malicious payloads are stored server-side and rendered without sanitization when administrators access the web-admin HTTPS interface's session list view. The CVSS 3.1 vector (5.4 MEDIUM: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects network accessibility, low attack complexity, and the requirement for valid TURN credentials or anonymous access in non-auth configurations. Cross-site scope (S:C) indicates the attack can escape the vulnerable component and affect other browser contexts.

Business impact

Compromise of administrator accounts represents a critical operational risk. Successful exploitation allows attackers to manipulate TURN session data, monitor media relay traffic metadata, modify server configuration, or disable legitimate relay services. In organizations relying on Coturn for WebRTC or VoIP infrastructure, this can disrupt communications, enable eavesdropping detection, or facilitate lateral network movement. The stored nature of the attack means all administrators viewing the session list are at persistent risk until the payload is removed and the server is patched.

Affected systems

Coturn versions prior to 4.11.0 are vulnerable. This includes all 4.10.x, 4.9.x, and earlier releases. The exposure scope depends on deployment posture: anonymous-access configurations (--no-auth flag enabled) present the lowest barrier to exploitation; authenticated deployments require valid TURN credentials or control over a provisioned username. Any organization running Coturn as a TURN/STUN relay for WebRTC applications, VoIP platforms, or real-time communication services should verify their version immediately.

Exploitability

Exploitation requires network access to the Coturn server and the ability to create TURN allocations. In anonymous-access mode (common in public relay deployments), this requires no credentials—any remote attacker can craft a malicious allocation. In credential-required deployments, an attacker needs valid TURN credentials, which may be provisioned to multiple users or obtainable through social engineering. The attack requires a low-skill payload (basic HTML/JavaScript injection) and triggers automatically when any authenticated administrator views the session list, making it reliable and repeatable. No known public exploits are tracked in the KEV catalog, but the simplicity of XSS payloads means functional proof-of-concept code is likely to emerge quickly.

Remediation

Upgrade Coturn to version 4.11.0 or later. Organizations unable to patch immediately should: restrict network access to the web-admin HTTPS interface using firewall rules or network segmentation (limit to trusted administrative networks); disable web-admin access if not actively used; implement monitoring for suspicious USERNAME values containing HTML/JavaScript syntax; and rotate administrator credentials after patching to invalidate any stolen session tokens. For deployments using anonymous access, consider enabling authentication (--auth or similar flags) to raise the barrier to exploitation.

Patch guidance

Update to Coturn 4.11.0 or any stable release after this version. Verify the patch version in your deployment by running the Coturn binary with --version or checking your package manager's version. If you are using a Linux distribution package (e.g., Ubuntu, CentOS, Debian), check the distribution's repository for available updates. For source builds, pull the latest code from the official Coturn repository and recompile. Test in a non-production environment first to ensure compatibility with your configuration. Restart the Coturn service after patching to load the fixed binary.

Detection guidance

Monitor web server and Coturn logs for allocation requests containing HTML tags (<, >), JavaScript keywords (script, onerror, onload, eval), or URL-encoded variants (%3C, %3E, %25) in the USERNAME field. Examine the session list view in the web-admin interface for suspicious HTML or script fragments in usernames—these will typically appear as unrendered or partially rendered markup. Check administrator browser console and network logs for failed script execution or CSP violations following their session list views. If a Coturn deployment uses anonymous access (--no-auth or similar), heighten vigilance on allocation request logs for any targeting of the USERNAME parameter.

Why prioritize this

Although CVSS 5.4 suggests medium risk, the actual business impact warrants prompt attention. This is a stored XSS in an administrative interface, meaning every authenticated admin is passively targeted. Successful compromise leads to account takeover with full server control. The low attack complexity and potential for unauthenticated exploitation in common deployments (anonymous TURN) elevate practical risk beyond the numerical score. Coturn is widely deployed in WebRTC infrastructure; patching should be prioritized within the next 30 days, sooner if the affected deployment handles sensitive communications.

Risk score, explained

The CVSS 5.4 MEDIUM score reflects: (1) network-based attack vector reducing barriers to entry, (2) low attack complexity (standard XSS payload injection), (3) requirement for low privilege (valid TURN credentials or anonymous access), (4) required user interaction (administrator must view the session list), and (5) limited direct impact on confidentiality and integrity from a single click. However, the stored persistence and administrative context elevate real-world risk; a single injection affects all future admin sessions until remediated. The lack of KEV listing does not diminish urgency—widespread Coturn usage and ease of exploitation suggest rapid weaponization potential.

Frequently asked questions