Is CVE-2026-65981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65981 being exploited in the wild.

How severe is CVE-2026-65981?

High severity, with a CVSS score of 7.1, published 31 July 2026.

Is there a fix for CVE-2026-65981?

A patch was published on 2026-07-03: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65981 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65981?

Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65981: Coturn authorization bypass in MICE mobility session resumption

CVE-2026-65981 · Severity: high · CVSS 7.1 · Published 2026-07-31

Coturn is an open-source server used to facilitate media traffic (like voice and video calls) between users who are behind firewalls. A security flaw in its 'mobility' feature allows an attacker with their own valid account to hijack another user's active connection if they can obtain a specific session ID. If successful, the attacker can intercept or inject data into the victim's call and use up the victim's data quota, effectively cutting off the legitimate user's service.

Technologies: Coturn. Vendors: Coturn.

Quick answers

Is CVE-2026-65981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65981 being exploited in the wild.
How severe is CVE-2026-65981?: High severity, with a CVSS score of 7.1, published 31 July 2026.
Which products and versions are affected?: Coturn < 4.15.0.
Is there a fix for CVE-2026-65981?: A patch was published on 2026-07-03: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65981 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65981?: Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in Coturn's implementation of the MICE (Mobility with ICE) feature when the --mobility flag is enabled. In the 'handle_turn_refresh' function, the server uses an attacker-supplied 56-bit mobile ID to locate a victim's session but fails to verify that the resuming user's identity matches the original allocation owner. Specifically, if an attacker is already authenticated on their own session, the server skips copying the original owner's credentials for validation, instead verifying the refresh request against the attacker's own HMAC key. This allows the attacker to successfully 'resume' and hijack the victim's socket, enabling traffic injection, interception, and quota exhaustion. The vulnerability is fixed in version 4.15.0 by making credential adoption unconditional during session resumption.

Affected products

coturn coturn < 4.15.0

Timeline

2026-07-03: patched: Fix committed to repository
2026-07-24: advisory: GitHub Security Advisory published
2026-07-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.