These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T21:17:31.857Z and has not been modified since then. Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original a [truncated]
The Coturn server, a free open source implementation of TURN and STUN Server, is vulnerable to a heap memory exposure issue. When Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to a loopback bypass issue. Prior to version 4.13.0, the default loopback guard can be circumvented by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. This allows an authenticated TURN client to expose services bound only to localhost on the Coturn host through TURN relay traffic. The vulnerabili [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to arbitrary file write via the psd print sessions dump CLI command. Prior to version 4.13.0, an authenticated admin with CLI access can directly pass a filename argument to fopen with no path validation, allowing truncation and overwrite with session dump data. This issue affects Coturn versions prior to 4.13.0 and can be mitigated by upgrad [truncated]
The Coturn implementation of TURN and STUN Server is vulnerable to SQL injection via the HTTPS admin panel. Prior to version 4.12.0, the admin panel passes HTTP query parameters directly into SQL queries without sanitization, allowing an authenticated admin to inject arbitrary SQL. This could lead to full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. The issue is fixed i [truncated]
Coturn, a free open-source implementation of TURN and STUN Server, is vulnerable to a stack buffer overflow in decode_oauth_token_gcm(). This issue allows an attacker to write up to 735 bytes of controlled data past a 256-byte stack buffer, potentially corrupting adjacent stack data, including control-flow data. The vulnerability exists in versions prior to 4.10.0 and is exploitable in --oauth mode, which [truncated]
Coturn, a free open-source implementation of TURN and STUN Server, has a stored cross-site scripting (XSS) vulnerability in its web-admin HTTPS interface. An attacker can create a TURN allocation with a crafted USERNAME value to inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. This issue may be exploitable without TURN credentials in configurations usi [truncated]