Coturn CVE-2026-68553

The attacker must hold valid TURN long-term credentials (username and password) for the targeted Coturn instance, corresponding to PR:L in the CVSS vector; unauthenticated exploitation is not possible. Coturn must have Redis integration enabled via configuration options such as --redis-userdb or --redis-statsdb - deployments backed by file-based, SQLite, PostgreSQL, or MySQL user databases do not reach the vulnerable send_message_to_redis() code path. The TURN/STUN service port (typically UDP/TCP 3478 or TLS 5349) must be network-reachable by the attacker. There is no requirement for elevated TURN privileges beyond standard user-level credentials, and no special client software is needed beyond a TURN-compliant client capable of crafting USERNAME or REALM attribute values containing percent signs. Exploitation is constrained by the need for valid credentials and the Redis dependency; environments that issue TURN credentials to untrusted or anonymous users (common in WebRTC signaling services) face materially higher risk.

The NVD CVSS 7.1 (High) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H is well-calibrated for this vulnerability: the attack is network-accessible and requires no special complexity beyond holding valid TURN credentials, the availability impact is High because a single crafted request can crash the coturn process and terminate all active TURN sessions, and confidentiality is Low due to stack memory potentially surfacing in Redis. No EPSS score was provided in the available intelligence, and no CISA KEV listing exists, so real-world exploitation frequency is unconfirmed. The practical risk is bounded by the PR:L requirement - attackers need valid TURN credentials - and by the further constraint that Redis integration must be enabled; deployments using file-based or SQL-backed user databases are not exposed by this code path. Despite the lack of a known public exploit, the vulnerability is straightforward to trigger with a minimal crafted TURN Allocate request once credentials are available, making it a meaningful availability risk for any public-facing WebRTC infrastructure that uses Redis-backed Coturn.

An attacker with valid TURN credentials - obtained legitimately, stolen, or through credential stuffing - sends a TURN Allocate request whose USERNAME attribute contains a printf format string such as user%s%x%n%s. Coturn embeds this value into a Redis key and passes the concatenated command-plus-key as the format argument to redisAsyncCommand() with only one variadic argument; redisvFormatCommand() reads past the va_list, either crashing the coturn process and dropping all concurrent WebRTC sessions or reading stack memory that may contain sensitive data into Redis. No public proof-of-concept code has been identified, but the exploit technique maps directly to the described code path and requires only a standard TURN client.