Executive brief
Coturn is an open-source server used for relaying media traffic in VoIP and WebRTC applications. A security flaw in its web-based administration panel allows an authorized administrator to bypass intended restrictions and execute unauthorized database commands. This could lead to the deletion of all user accounts, the creation of backdoor access, or potentially full control over the underlying server operating system.
Technical details
An SQL injection vulnerability exists in the Coturn HTTPS admin panel due to the lack of input sanitization in the 'delete-user' (du), 'delete-secret' (ds), and 'delete-IP' (dip) handlers. While the STUN protocol path uses the 'is_secure_string' filter, the admin panel's 'turn_admin_server.c' component passes HTTP query parameters directly into SQL queries via 'snprintf' string interpolation. An authenticated attacker with admin privileges can inject arbitrary SQL commands. On PostgreSQL backends, this can be escalated to OS-level command execution via stacked queries and the 'COPY TO PROGRAM' command. The issue is resolved in version 4.12.0 by applying 'is_secure_string' and 'check_ip_list_range' validation to these parameters.
Affected products
- coturn coturn < 4.12.0
Timeline
- 2026-05-24: patched: Fix merged into master branch via PR #1924
- 2026-05-26: other: Release 4.12.0 published
- 2026-06-26: advisory: GitHub Security Advisory GHSA-v8hj-2xx7-xmp5 published
- 2026-07-10: disclosed: CVE-2026-53448 published to NVD