Coturn EUVD-2026-63080

Two specific conditions must both be satisfied: (1) the target Coturn server must be started with the --mobility flag, which enables RFC 8016 TURN mobility support and is not part of the default configuration - operators must explicitly opt in; and (2) the attacker must possess valid authenticated TURN credentials (CVSS PR:L), either obtained legitimately (e.g., a tenant in a multi-user relay) or through prior credential compromise. Additionally, the abuse pattern requires raw STUN manipulation - standard TURN client tools such as turnutils_uclient complete handoffs and do not reproduce the vulnerability, as documented explicitly in the patch commit's regression test. Limiting factors: the --mobility non-default requirement, the need for authenticated credentials, and the need for custom raw-STUN tooling together restrict exploitation to motivated, credentialed attackers targeting specifically configured servers. The --user-quota setting, even at 1, does not limit exploitation because orphaned pending sessions bypass quota tracking.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) correctly identifies a network-reachable, low-authentication DoS with high availability impact. However, AC:L may overstate ease of exploitation: the --mobility flag is non-default and must be intentionally enabled by the operator, a condition outside attacker control that arguably supports AC:H. The bypass of --user-quota=1 is operationally significant - teams relying on quota controls as a DoS guardrail receive no protection, amplifying realistic impact beyond the base score. No CISA KEV listing is present and no EPSS score was provided in the source data; the non-default --mobility requirement and valid-credential prerequisite substantially limit the population of exploitable deployments. The patch commit includes a complete regression test that drives the exact abuse pattern, making weaponization straightforward for any attacker with the test harness. Risk is moderate: high for operators running Coturn with --mobility in multi-tenant or public-relay configurations; low for those without the flag enabled.

An attacker with valid TURN credentials targets a Coturn 4.15.0 server configured with --mobility. Using raw STUN (not a standard TURN client, which completes handoffs), the attacker allocates a single mobility-enabled allocation and then sends repeated Refresh requests from successive fresh UDP 5-tuples, never completing the RFC 8016 handoff on any of them. Each resume overwrites the prior pending-session backlink and orphans the previous pending session; over dozens to hundreds of iterations, accumulated orphaned sessions exhaust server process memory, degrading or crashing the TURN relay.