Executive brief
mediasoup is a WebRTC media server used to build audio/video communication platforms. Its SCTP protocol implementation (for reliable data channels) fails to properly authenticate state cookies, allowing an attacker positioned on the network path to forge handshake messages and inject data into SCTP streams as if they were the legitimate peer. This affects deployments using PlainTransport with SCTP but without encryption (SRTP), potentially enabling unauthorized message injection or service disruption in server-to-server communication.
Technical details
The vulnerability is a cryptographic authentication bypass in mediasoup's SCTP stack (introduced in v3.20.0). The StateCookie structure is validated only by checking two hardcoded magic byte sequences ("msworker" and 0xAD81) rather than using a per-instance HMAC as required by RFC 9260 Section 5.1.3. When handling incoming COOKIE-ECHO chunks, the code compares the SCTP packet's verification tag against the attacker-controlled localVerificationTag field within the cookie itself—since an attacker controls both values, they can set them equal and bypass validation. Additionally, SCTP CRC32c checksum validation is implemented but never invoked on the receive path. The vulnerability requires network-level access to send UDP packets to the target (or can be exploited from any source if comedia mode is enabled), and only affects PlainTransport with SCTP enabled and no SRTP encryption; WebRtcTransport is unaffected because its SCTP runs inside a DTLS tunnel. Patches were released in v3.20.6 (npm) and v0.22.5 (Rust).
Affected products
- mediasoup mediasoup >=3.20.0, <=3.20.5 (npm); >=0.22.0, <=0.22.4 (Rust)
Timeline
- 2026-06-15: disclosed: GitHub Advisory published (GitHub Reviewed)
- 2026-06-15: patched: Patches released: mediasoup v3.20.6 (npm) and v0.22.5 (Rust)
- 2026-08-25: advisory: Advisory updated