EUVD-2026-37941Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAuth-enabled TURN listener
-
DeliverySend crafted OAuth access token
-
ExploitOversized nonce_len passed to memcpy()
-
ExecutionOverflow 256-byte stack nonce buffer
-
PersistCorrupt adjacent stack/control-flow data
-
ImpactCrash service or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The server MUST be running in --oauth mode (explicitly noted as non-default) for the vulnerable decode_oauth_token_gcm() path to be reachable - this is the single hard prerequisite and the primary limiting factor. Given that mode, NO further conditions apply: the attack is remote and unauthenticated (CVSS PR:N/UI:N), and the attacker does NOT need the OAuth signing key or a valid AES-GCM token because the overflow occurs before authentication verification. Realistic risk is therefore bounded by how many Coturn instances enable OAuth (the advisory notes --oauth is 'commonly recommended,' raising exposure) and by exploit mitigations such as stack canaries/ASLR/CFI, which the description says determine whether the primitive escalates from crash to RCE. |
| Impact | Signals are mixed and should be weighed carefully. The CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) reflects the worst case - pre-auth remote memory corruption with a plausible RCE primitive - and SSVC rates Technical Impact as 'total', consistent with full-compromise potential. However, several factors temper urgency: SSVC marks Automatable: no, EPSS is low at 0.36% (27th percentile), the CVE is NOT in CISA KEV, and exploitation requires the non-default --oauth configuration. The CVSS base vector does not penalize this configuration dependency, so 9.8 overstates risk for the majority of deployments that run without OAuth. Critically, the description frames RCE as 'plausible depending on exploit mitigations' (compiler/ABI/stack protections), so reliable code execution is NOT confirmed, whereas a remote denial-of-service via stack corruption/crash is highly credible. Net: high priority for the subset of operators running --oauth, moderate elsewhere; treat RCE as possible-but-unproven and DoS as likely. |
| Exploit ScenarioDerived | An attacker who can reach an internet-facing Coturn server running in --oauth mode crafts a malformed OAuth access token whose embedded nonce_len field is set far above 256, then sends it during a TURN authentication exchange. Coturn copies the oversized nonce into a 256-byte stack buffer before verifying the AES-GCM tag, overflowing it by up to 735 bytes of attacker-controlled data and corrupting adjacent stack/control-flow data - yielding at minimum a remote crash (DoS) and potentially code execution depending on stack mitigations. Proof-of-concept exploit code exists per the SSVC assessment, though no active exploitation is recorded in CISA KEV. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm()) lets remote unauthenticated attackers corrupt the server stack in all versions prior to 4.10.0. An attacker-controlled uint16_t nonce_len value (up to 65535) read from an OAuth access token is passed straight into memcpy() against a 256-byte stack buffer before any AES-GCM authentication, so no OAuth key or valid token is required to write up to 735 bytes past the buffer. Publicly available exploit code exists (SSVC: PoC) but it is not in CISA KEV, EPSS is low at 0.36% (27th percentile), and exploitation is gated on the non-default --oauth mode being enabled.
Earlier versions of this analysis (2)
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm) allows remote attackers to overflow a 256-byte stack buffer by up to 735 bytes when the server runs in --oauth mode, affecting all versions before 4.10.0. Because the attacker-controlled uint16_t nonce_len is memcpy'd before AES-GCM authentication is checked, no valid token or knowledge of the OAuth key is required, making this a pre-authentication memory-corruption primitive with plausible (but mitigation-dependent) remote code execution. No public exploit identified at time of analysis; the issue is rated CVSS 9.8 with SSVC technical impact 'total', though EPSS exploitation probability is low at 0.36%.
Remote stack buffer overflow in Coturn TURN/STUN server (versions prior to 4.10.0) allows unauthenticated attackers to write up to 735 bytes of controlled data past a 256-byte stack buffer via a crafted OAuth access token, with the overflow triggering before AES-GCM authentication is verified. No public exploit identified at time of analysis, but the flaw provides a plausible RCE primitive on deployments running --oauth mode, which is commonly recommended for WebRTC infrastructure. CVSS 8.1 reflects high impact tempered by AC:H, since reliable code execution depends on bypassing compiler and ABI stack mitigations.
RemediationAI
Vendor-released patch: 4.10.0 - upgrade Coturn to 4.10.0 or later, which contains the fix titled 'Fix stack buffer overflow in OAuth token decoding' (PR #1850) per the release notes (https://github.com/coturn/coturn/releases/tag/4.10.0); review advisory GHSA-74pg-rfh2-5qw5 for details. If immediate patching is not possible, the most effective compensating control is to disable OAuth by removing the --oauth flag/oauth configuration so the vulnerable decode_oauth_token_gcm() path is never reached - the trade-off is loss of third-party OAuth-based TURN authentication, requiring fallback to long-term-credential or static auth mechanisms. As an additional control, restrict network reachability of the TURN listener (typically 3478 and TLS 5349) to trusted client ranges or place it behind rate-limiting, accepting that this conflicts with TURN's need to serve arbitrary WebRTC clients on the public internet. Note that 4.10.0 also fixes CVE-2026-40613 and other memory issues, so upgrading is preferable to workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Coturn is the de facto open-source TURN/STUN relay server underpinning WebRTC media traversal (audio/video calls, conferencing) behind NAT/firewalls. The flaw is a classic CWE-120 buffer overflow with no bounds check: the OAuth token-decryption routine decode_oauth_token_gcm() reads a length field (nonce_len, a 16-bit value 0-65535) directly from the attacker-supplied token and uses it as the copy length into a fixed 256-byte stack array (oauth_encrypted_block.nonce[256]). Because the copy happens before the AES-GCM tag is verified, the authentication that would normally reject forged tokens never executes, removing the need to know the OAuth key. The affected component is identified by cpe:2.3:a:coturn:coturn:*:*:*:*:*:*:*:* and is reachable only when the server is started in --oauth mode.
Know when Coturn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth remote overflow before the AES-GCM check gives AV:N/AC:L/PR:N/UI:N; impacts set High for the plausible RCE primitive, since the --oauth dependency is environmental rather than a base metric.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.
Executive ViewAI
Coturn versions prior to 4.10.0 contain a critical unauthenticated stack buffer overflow in the OAuth token decoder that enables remote attackers to corrupt server memory and potentially compromise relay infrastructure. The vulnerability affects organizations using Coturn's non-default --oauth mode; exploitation requires no valid credentials. While publicly available exploit code exists, current exploitation risk remains low (EPSS 0.36th percentile) and no active compromise has been reported.
Apply vendor patch. If immediate patching is delayed: disable --oauth mode if not required for operations; restrict Coturn access to trusted networks via firewall rules; monitor system logs for exploitation attempts targeting the decode_oauth_token_gcm() function.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. R
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. Rated h
Coturn TURN/STUN server contains an access control bypass that allows remote attackers to reach blocked internal address
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a s
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. Rated
Server-side request forgery in coturn TURN/STUN server before 4.13.0 lets an authenticated TURN client bypass the defaul
SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated admi
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack m
Unauthenticated remote attackers can leak residual stack memory from Coturn 4.10.0 by sending a TURN Allocate request wi
Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing
Arbitrary file overwrite in Coturn prior to 4.13.0 is possible through the CLI management interface's `psd` (print sessi
Stored XSS in Coturn's web-admin HTTPS interface (all versions prior to 4.11.0) allows a TURN-level attacker to inject p
Exploit-DB