Executive brief
Coturn is an open-source server used to facilitate media traffic (like voice and video calls) between users who are behind firewalls. A security flaw in its 'mobility' feature allows an attacker with their own valid account to hijack another user's active connection if they can obtain a specific session ID. If successful, the attacker can intercept or inject data into the victim's call and use up the victim's data quota, effectively cutting off the legitimate user's service.
Technical details
An authorization bypass exists in Coturn's implementation of the MICE (Mobility with ICE) feature when the --mobility flag is enabled. In the 'handle_turn_refresh' function, the server uses an attacker-supplied 56-bit mobile ID to locate a victim's session but fails to verify that the resuming user's identity matches the original allocation owner. Specifically, if an attacker is already authenticated on their own session, the server skips copying the original owner's credentials for validation, instead verifying the refresh request against the attacker's own HMAC key. This allows the attacker to successfully 'resume' and hijack the victim's socket, enabling traffic injection, interception, and quota exhaustion. The vulnerability is fixed in version 4.15.0 by making credential adoption unconditional during session resumption.
Affected products
- coturn coturn < 4.15.0
Timeline
- 2026-07-03: patched: Fix committed to repository
- 2026-07-24: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date