CVE-2026-68554 coturn CVE debrief

Who should care

Defenders responsible for Coturn deployments, especially those using UDP or TCP without TLS or DTLS, should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that Coturn deployments are updated to version 4.15.0 or later and that compensating controls such as TLS or DTLS are implemented.

Why it matters

Defenders should care about CVE-2026-68554 because it allows on-path attackers to manipulate Coturn deployments using UDP or TCP without TLS or DTLS, potentially leading to unauthorized modifications or bypasses. Verification of Coturn version and deployment configuration is crucial, along with implementation of compensating controls.

• Potential modification of allocation lifetime
• Injection of permissions or bypass of origin checks
• Verification of Coturn version and deployment configuration
• Implementation of compensating controls such as TLS or DTLS

Technical summary

The Coturn implementation of TURN and STUN Server is vulnerable to an on-path attack, allowing an attacker to append attributes to an authenticated STUN request on plain UDP or TCP. This issue is fixed in version 4.15.0. The vulnerability allows for potential modification of allocation lifetime, injection of permissions, or bypass of origin checks. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check.

Defensive priority

Defenders should prioritize verifying Coturn deployments for version 4.15.0 or later, especially those using UDP or TCP without TLS or DTLS, and assess exposure to potential on-path attackers.

Recommended defensive actions

• Verify Coturn deployments for version 4.15.0 or later
• Assess exposure to potential on-path attackers
• Implement TLS or DTLS for Coturn deployments using UDP or TCP
• Confirm whether affected Coturn deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Coturn, an open-source implementation of TURN and STUN Server, which allows an on-path attacker to append attributes to an authenticated STUN request. The issue is fixed in version 4.15.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.