What is the CVSS score of CVE-2026-53448?

CVE-2026-53448 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Coturn are affected by CVE-2026-53448?

Coturn TURN/STUN server versions prior to 4.12.0 contain a vulnerability in the administrative console that allows administrators to inject arbitrary SQL commands and gain full control of the backend…. A patch is available.

How to fix or mitigate CVE-2026-53448?

Within 24 hours: Audit all Coturn deployments to identify affected versions (pre-4.12.0); determine whether admin panels are accessible from untrusted networks. Within 7 days: Upgrade all instances to Coturn 4.12.0 or later; implement network-level restrictions to limit admin panel access to trusted networks only. Within 30 days: Review administrative access logs for suspicious activity; verify patched version deployment across all systems.

Coturn CVE-2026-53448

EUVD-2026-42969 HIGH

SQL Injection (CWE-89)

2026-07-10 GitHub_M

PostgreSQL SQLi Coturn Red Hat Suse

7.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable admin panel with low-complexity SQLi, but requires authenticated admin (PR:H); full C/I/A loss of the database, scope kept U though COPY TO PROGRAM host compromise could justify S:C.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.2 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 19:01 EUVD

Analysis Generated

Jul 10, 2026 - 18:56 vuln.today

DescriptionCVE.org

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.

AnalysisAI

SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated administrator to inject arbitrary SQL via the du, ds, and dip query parameters of the delete-user, delete-secret, and delete-IP operations, yielding full backend database control and, on PostgreSQL deployments, OS-level command execution through COPY TO PROGRAM. The admin panel's parameters are interpolated into queries with snprintf while bypassing the is_secure_string filter that guards the STUN protocol path. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV; fixed in Coturn 4.12.0.

Technical ContextAI

Coturn is the de-facto open-source implementation of TURN (RFC 5766/8656) and STUN, widely deployed as relay infrastructure for WebRTC, VoIP, and video-conferencing. The affected component is Coturn's optional web-based admin console served over HTTPS, which manages the credential store (long-term users, shared secrets, and permitted/denied IP peers). Per the advisory, these admin operations build SQL statements via snprintf-based string interpolation of HTTP query parameters. Root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the is_secure_string sanitization routine that protects the STUN protocol code path was never wired into the admin panel's delete handlers, leaving du (delete-user), ds (delete-secret), and dip (delete-IP) unsanitized. When the backend is PostgreSQL, the injectable statement can be escalated beyond data access to arbitrary OS command execution using PostgreSQL's COPY ... TO PROGRAM functionality, running as the database service account. Affected CPE: cpe:2.3:a:coturn:coturn:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to Coturn 4.12.0 or later (https://github.com/coturn/coturn/releases/tag/4.12.0), which applies the is_secure_string sanitization to the admin panel delete operations as implemented in PR 1924 / commit b84dbab1d1aa6e2bf0211a1cdbb250d6de2a0d09; review details in advisory GHSA-v8hj-2xx7-xmp5. If immediate patching is not possible, disable the HTTPS admin panel entirely (it is optional) or restrict it to a trusted management network/VPN and place it behind an authenticating reverse proxy with an allowlist, accepting the trade-off that remote administration becomes unavailable or gated. Additionally, harden the database backend to blunt the escalation path: run the PostgreSQL role used by Coturn as an unprivileged, non-superuser account (COPY TO PROGRAM requires superuser or pg_execute_server_program), which prevents OS command execution but does not stop in-database data tampering. Rotate admin credentials and enforce strong, unique passwords, since exploitation requires a valid admin session.