Executive brief
Coturn is an open-source server used to facilitate WebRTC video and audio communication by helping data bypass firewalls. A security flaw in how the server handles authentication tokens allows an attacker to send a specially crafted message that crashes the service or potentially takes control of the server. While the server must be configured with OAuth enabled to be vulnerable, this is a common setup for professional video conferencing and communication platforms.
Technical details
A stack buffer overflow exists in the 'decode_oauth_token_gcm()' function within 'src/client/ns_turn_msg.c'. The vulnerability is caused by a lack of bounds checking on the 'nonce_len' field (a uint16_t) read from an attacker-supplied OAuth access token. This value is passed directly to 'memcpy()', copying up to 65535 bytes into a fixed 256-byte stack buffer ('oauth_encrypted_block.nonce'). Because the overflow occurs before AES-GCM authentication is verified, an attacker does not need a valid OAuth key. Exploitation requires the server to be running in '--oauth' mode. Successful exploitation can lead to corruption of the saved return address, potentially enabling remote code execution (RCE) or causing a process crash (DoS). The issue is fixed in version 4.10.0.
Affected products
- coturn coturn < 4.10.0
Timeline
- 2026-04-14: patched: Version 4.10.0 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD