CVE-2026-65981 coturn CVE debrief

Who should care

Coturn users and administrators should be aware of this vulnerability and take steps to verify their Coturn version, restrict MOBILITY-TICKET usage, and monitor for suspicious relayed traffic. Affected Coturn deployments may be vulnerable to traffic injection and quota consumption.

Technical summary

Coturn 4.15.0 fixes a vulnerability allowing authenticated attackers to inject relayed traffic and consume victim quota via MOBILITY-TICKET. The issue arises from the server using --mobility authenticating a resumed REFRESH request with the resuming user's credentials but not verifying that identity against the original allocation owner. This enables an attacker with a victim's MOBILITY-TICKET to inject relayed traffic and consume the victim's quota.

Defensive priority

Authenticated attackers with MOBILITY-TICKET can inject relayed traffic and consume victim quota.

Recommended defensive actions

• Verify Coturn version is 4.15.0 or later
• Restrict MOBILITY-TICKET usage to authenticated users
• Monitor for suspicious relayed traffic
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Coturn server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner. This allows an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. Evidence is limited; verify Coturn version, MOBILITY-TICKET usage, and monitor for suspicious relayed traffic. Limited evidence suggests Coturn versions prior to 4.15.0 are affected. Users should verify Coturn version and review MOBILITY-TICKET usage.

Official resources