EUVD-2026-37939Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:N captures the worst-case --no-auth anonymous path; S:C reflects XSS crossing from TURN client into authenticated admin session context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.
AnalysisAI
Stored XSS in Coturn's web-admin HTTPS interface (all versions prior to 4.11.0) allows a TURN-level attacker to inject persistent JavaScript that executes in an authenticated administrator's browser when they view the session list. The attack is staged via a crafted USERNAME value in a TURN Allocate request, bridging the TURN protocol surface into the web-admin UI context. In anonymous deployments (--no-auth), no TURN credentials are required for the injection phase, broadening the exposure; in authenticated deployments the attacker must hold valid TURN credentials. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Coturn is a widely deployed open-source TURN and STUN relay server (cpe:2.3:a:coturn:coturn:*:*:*:*:*:*:*:*), commonly used as the media relay backbone for WebRTC applications. The web-admin HTTPS interface provides administrators a real-time view of active TURN sessions, including their associated USERNAME values. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the USERNAME field supplied by TURN clients during an Allocate request is stored server-side and later rendered in the admin session list without HTML encoding or content-security sanitization. Because TURN usernames are fully attacker-controlled, this creates a persistent XSS vector that bridges the TURN protocol layer into the privileged web-admin context. The scope change reflected in the CVSS vector (S:C) captures this cross-context boundary: an unprivileged TURN client's input ultimately executes code in the authenticated admin session.
RemediationAI
Upgrade Coturn to version 4.11.0, which contains the vendor-released patch for this XSS along with several other security fixes including a format-string injection fix in the Redis DB driver (PR #1870) and a constant-time HMAC comparison hardening (PR #1869), making the upgrade broadly advisable beyond this single issue. See the release notes at https://github.com/coturn/coturn/releases/tag/4.11.0 and advisory at https://github.com/coturn/coturn/security/advisories/GHSA-xxf5-9vj2-g84j. If immediate upgrade is not feasible, disable the web-admin HTTPS interface entirely to eliminate the XSS rendering surface - note this removes all web-based session visibility. Alternatively, restrict web-admin access to trusted internal networks via firewall rules, preventing external TURN clients from leveraging stored payloads against remote administrators. For deployments running --no-auth, enabling TURN authentication raises the attacker's barrier from unauthenticated to requiring valid credentials, though this may break anonymous WebRTC client flows and requires credential provisioning.
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. R
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. Rated h
Coturn TURN/STUN server contains an access control bypass that allows remote attackers to reach blocked internal address
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm()) lets remote unauthenticated attackers c
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a s
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. Rated
Server-side request forgery in coturn TURN/STUN server before 4.13.0 lets an authenticated TURN client bypass the defaul
SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated admi
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack m
Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing
Arbitrary file overwrite in Coturn prior to 4.13.0 is possible through the CLI management interface's `psd` (print sessi
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote cli
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today