CVE-2026-68554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68554", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-30T19:56:44.102Z", "datePublished": "2026-08-19T20:38:28.419Z", "dateUpdated": "2026-08-20T13:36:14.992Z"}, "containers": {"cna": {"title": "Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-924", "lang": "en", "description": "CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc"}, {"name": "https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978"}, {"name": "https://github.com/coturn/coturn/releases/tag/4.15.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/coturn/coturn/releases/tag/4.15.0"}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"version": "< 4.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T20:38:28.419Z"}, "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0."}], "source": {"advisory": "GHSA-5538-7cxj-5jcc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T13:31:52.424319Z", "id": "CVE-2026-68554", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:36:14.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68554", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T13:31:52.424319Z"}}}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T13:33:06.694Z"}}], "cna": {"title": "Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests", "source": {"advisory": "GHSA-5538-7cxj-5jcc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "ADJACENT", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "coturn", "product": "coturn", "versions": [{"status": "affected", "version": "< 4.15.0"}]}], "references": [{"url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc", "name": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978", "name": "https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coturn/coturn/releases/tag/4.15.0", "name": "https://github.com/coturn/coturn/releases/tag/4.15.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-924", "description": "CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T20:38:28.419Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68554", "state": "PUBLISHED", "dateUpdated": "2026-08-20T13:36:14.992Z", "dateReserved": "2026-07-30T19:56:44.102Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T20:38:28.419Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coturn", "vendor": "coturn", "versions": [{"status": "affected", "version": "< 4.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0."}, {"lang": "es", "value": "Coturn es una implementaci\u00f3n de c\u00f3digo abierto gratuita de servidor TURN y STUN. Antes de la versi\u00f3n 4.15.0, un atacante en la ruta puede a\u00f1adir atributos despu\u00e9s de MESSAGE-INTEGRITY a una solicitud STUN autenticada en UDP o TCP sin cifrar, ajustar la longitud del encabezado STUN y recalcular el FINGERPRINT sin clave mientras el HMAC original sigue siendo v\u00e1lido porque solo cubre el prefijo del mensaje. El an\u00e1lisis del lado del servidor en src/server/ns_turn_server.c contin\u00faa m\u00e1s all\u00e1 de MESSAGE-INTEGRITY a trav\u00e9s de handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh() y handle_turn_command(), permitiendo que los atributos finales LIFETIME, XOR-PEER-ADDRESS u ORIGIN anulen la vida \u00fatil de la asignaci\u00f3n, inyecten un permiso o eludan la verificaci\u00f3n de origen. Las implementaciones de TLS y DTLS evitan esta modificaci\u00f3n en tr\u00e1nsito. Este problema est\u00e1 corregido en la versi\u00f3n 4.15.0."}], "id": "CVE-2026-68554", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68554", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T13:31:52.424319Z", "version": "2.0.3"}}]}, "published": "2026-08-19T21:17:28.310", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/releases/tag/4.15.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-924"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "coturn: Coturn: Unauthorized actions or resource manipulation via STUN request modification", "id": "2520325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520325"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-354", "details": ["Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.", "A flaw was found in Coturn, a free open source implementation of TURN and STUN (Session Traversal Utilities for NAT) Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows the attacker to modify the request by overriding allocation lifetime, injecting permissions, or bypassing origin checks, potentially leading to unauthorized actions or resource manipulation."], "mitigation": {"lang": "en:us", "value": "Upgrade to coturn version 4.15.0 or later. Deployments using TLS or DTLS transports are not vulnerable to this issue."}, "name": "CVE-2026-68554", "public_date": "2026-08-19T20:38:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68554\nhttps://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978\nhttps://github.com/coturn/coturn/releases/tag/4.15.0\nhttps://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc"], "statement": "Coturn is not shipped in any Red Hat product. The Fedora and EPEL community builds ship coturn version 4.17.2, which already includes the fix for this issue (fixed in 4.15.0) and are therefore not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coturn", "source": "cna", "vendor": "coturn"}, "product": "coturn", "vendor": "coturn"}], "created": "2026-08-20T01:15:03.908605+00:00", "updated": "2026-08-22T02:15:03.743872+00:00", "vendors": ["coturn", "coturn$PRODUCT$coturn"]}