EUVD-2026-51651Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
AV:N as the REFRESH is sent remotely; AC:H for non-default --mobility flag and MOBILITY-TICKET possession prerequisite; PR:L for required prior authenticated session; C:H/I:H for full relayed stream read/write access; A:L for quota exhaustion only; S:U as no scope change occurs.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.
AnalysisAI
Session hijacking in Coturn TURN/STUN server prior to 4.15.0 allows an authenticated attacker who obtains a victim's MOBILITY-TICKET to seize the victim's TURN allocation, intercepting and injecting relayed traffic while exhausting the victim's quota. The flaw resides in the --mobility (MICE, RFC 8016) session-resume code path in handle_turn_refresh: the server locates the victim allocation via an attacker-controlled mobile ID and then validates the REFRESH against the attacker's own credentials rather than the allocation owner's, because the hmackey_set flag set during the attacker's own prior authentication is never cleared for long-term-credential sessions and silently suppresses the credential-copy step. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H and PR:L reflect that exploitation requires both a legitimate authenticated session and possession of the victim's MOBILITY-TICKET.
Technical ContextAI
Coturn implements RFC 8016 (Mobility with TURN), which introduces MOBILITY-TICKET attributes allowing TURN clients to migrate allocations across network changes such as Wi-Fi-to-cellular handoffs. The vulnerable logic is in handle_turn_refresh (src/server/ns_turn_server.c): when a REFRESH carrying a MOBILITY-TICKET arrives, the server locates the original allocation struct (orig_ss) using the mobile ID supplied by the attacker, then conditionally invokes copy_auth_parameters(orig_ss, ss) to adopt the original owner's credentials - but only when the resuming session is unauthenticated (hmackey_set == 0). Because an attacker who performed their own prior long-term-credential authentication already has hmackey_set set to 1, the credential copy is skipped entirely, and check_stun_auth validates the REFRESH against the attacker's identity. This is a textbook CWE-639 (Authorization Through User-Controlled Key) flaw: the mobile ID is a user-controlled key that grants allocation access without a binding verification between the key and the authenticated identity of the original allocation owner. The server also does not verify that the identity resuming the allocation matches the identity that created it.
RemediationAI
Upgrade Coturn to version 4.15.0 or later; this is the only confirmed fix per GitHub Security Advisory GHSA-69wx-x7x6-pjj8 and upstream commit 37df0513168f830a7c9ce0a411db0300fa182f05. As an immediate compensating control where upgrade is not feasible, remove the --mobility flag from the Coturn server configuration or startup command; this eliminates the vulnerable handle_turn_refresh resume branch entirely, but removes RFC 8016 MICE functionality and will break mobile TURN clients that rely on MOBILITY-TICKET session migration. No workaround is known that preserves mobility functionality while closing the authentication bypass. Additionally, restrict TURN server access to trusted, identified clients only, and monitor REFRESH traffic for cross-source-address ticket usage as an anomaly indicator of exploitation attempts.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today