Coturn EUVD-2026-37939

Two distinct exploitation paths exist depending on deployment configuration. In anonymous deployments using the --no-auth flag, no TURN credentials are required to create an allocation and inject the malicious USERNAME - any network-reachable attacker can stage the payload. In authenticated deployments (the default), the attacker must possess valid TURN credentials or control a provisioned TURN username (e.g., a compromised VoIP extension or WebRTC client identity). In both cases, the XSS payload only executes when an authenticated web-admin user actively navigates to the session list page (UI:R); if no administrators use the web-admin interface or if it is disabled, exploitation cannot complete. The web-admin HTTPS interface must be enabled and network-accessible to the victim administrator's browser. Exploitation is not possible against Coturn instances with the web-admin interface disabled.

The provided CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C reflects the authenticated TURN case, but the CVE description explicitly identifies a more severe attack path in --no-auth deployments where TURN credentials are not required, effectively reducing the privilege requirement to PR:N and raising the real-world score. The scope change (S:C) is the most operationally significant metric: TURN clients are untrusted external actors whose input should never influence an administrative UI. UI:R (admin must view the session list) is a genuine limiting factor that reduces automation potential. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC has been identified, indicating no confirmed active exploitation at time of analysis. However, Coturn is extremely prevalent in WebRTC and VoIP deployments, many of which run in anonymous mode to support guest access - this deployment pattern meaningfully elevates real-world exposure above what the Medium CVSS score alone suggests.

An attacker targeting a Coturn deployment configured with --no-auth sends a TURN Allocate request to the public TURN port with a USERNAME value containing a JavaScript payload such as a fetch-based cookie exfiltration script. The server stores the crafted username in the active session table. When a Coturn administrator logs into the web-admin panel and navigates to the session list, the stored payload executes in their browser, silently forwarding the admin session token to an attacker-controlled endpoint and potentially enabling full administrative takeover of the Coturn configuration.