EUVD-2026-37941Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth remote overflow before the AES-GCM check gives AV:N/AC:L/PR:N/UI:N; impacts set High for the plausible RCE primitive, since the --oauth dependency is environmental rather than a base metric.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs before AES-GCM authentication is verified, the attacker does not need to know the OAuth key or produce a valid AES-GCM token. Up to 735 bytes of attacker-controlled data are written past the buffer, may corrupt adjacent stack data, including control-flow data depending on compiler, ABI, and mitigations. Requires --oauth mode (non-default). This may provide a plausible RCE primitive depending on exploit mitigations; because coturn is widely deployed for WebRTC TURN/STUN and --oauth is commonly recommended, impact can be broad. This issue has been fixed in version 4.10.0.
AnalysisAI
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm()) lets remote unauthenticated attackers corrupt the server stack in all versions prior to 4.10.0. An attacker-controlled uint16_t nonce_len value (up to 65535) read from an OAuth access token is passed straight into memcpy() against a 256-byte stack buffer before any AES-GCM authentication, so no OAuth key or valid token is required to write up to 735 bytes past the buffer. Publicly available exploit code exists (SSVC: PoC) but it is not in CISA KEV, EPSS is low at 0.36% (27th percentile), and exploitation is gated on the non-default --oauth mode being enabled.
Technical ContextAI
Coturn is the de facto open-source TURN/STUN relay server underpinning WebRTC media traversal (audio/video calls, conferencing) behind NAT/firewalls. The flaw is a classic CWE-120 buffer overflow with no bounds check: the OAuth token-decryption routine decode_oauth_token_gcm() reads a length field (nonce_len, a 16-bit value 0-65535) directly from the attacker-supplied token and uses it as the copy length into a fixed 256-byte stack array (oauth_encrypted_block.nonce[256]). Because the copy happens before the AES-GCM tag is verified, the authentication that would normally reject forged tokens never executes, removing the need to know the OAuth key. The affected component is identified by cpe:2.3:a:coturn:coturn:*:*:*:*:*:*:*:* and is reachable only when the server is started in --oauth mode.
RemediationAI
Vendor-released patch: 4.10.0 - upgrade Coturn to 4.10.0 or later, which contains the fix titled 'Fix stack buffer overflow in OAuth token decoding' (PR #1850) per the release notes (https://github.com/coturn/coturn/releases/tag/4.10.0); review advisory GHSA-74pg-rfh2-5qw5 for details. If immediate patching is not possible, the most effective compensating control is to disable OAuth by removing the --oauth flag/oauth configuration so the vulnerable decode_oauth_token_gcm() path is never reached - the trade-off is loss of third-party OAuth-based TURN authentication, requiring fallback to long-term-credential or static auth mechanisms. As an additional control, restrict network reachability of the TURN listener (typically 3478 and TLS 5349) to trusted client ranges or place it behind rate-limiting, accepting that this conflicts with TURN's need to serve arbitrary WebRTC clients on the public internet. Note that 4.10.0 also fixes CVE-2026-40613 and other memory issues, so upgrading is preferable to workarounds.
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. R
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. Rated h
Coturn TURN/STUN server contains an access control bypass that allows remote attackers to reach blocked internal address
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a s
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. Rated
Server-side request forgery in coturn TURN/STUN server before 4.13.0 lets an authenticated TURN client bypass the defaul
SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated admi
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack m
Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing
Arbitrary file overwrite in Coturn prior to 4.13.0 is possible through the CLI management interface's `psd` (print sessi
Stored XSS in Coturn's web-admin HTTPS interface (all versions prior to 4.11.0) allows a TURN-level attacker to inject p
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote cli
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today