https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:00:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-348503 EUVD-2026-348503 https://cve.radiocsirt.org/vuln/euvd-2026-348503 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65981 <p>Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user&#39;s credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim&#39;s quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker&#39;s session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker&#39;s own identity rather than the allocation owner&#39;s. This issue is fixed in version 4.15.0.</p> <p>Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user&#39;s credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim&#39;s quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker&#39;s session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker&#39;s own identity rather than the allocation owner&#39;s. This issue is fixed in version 4.15.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65981 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11617-1 <p>coturn-4.17.2-1.1 on GA media</p> <p>coturn-4.17.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11617-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65981 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: coturn, Ubuntu:18.04:LTS: coturn, Ubuntu:20.04:LTS: coturn, Ubuntu:22.04:LTS: coturn, Ubuntu:24.04:LTS: coturn, Ubuntu:26.04:LTS: coturn</p> <p>Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user&#39;s credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim&#39;s quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker&#39;s session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker&#39;s own identity rather than the allocation owner&#39;s. This issue is fixed in version 4.15.0.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: coturn, Ubuntu:18.04:LTS: coturn, Ubuntu:20.04:LTS: coturn, Ubuntu:22.04:LTS: coturn, Ubuntu:24.04:LTS: coturn, Ubuntu:26.04:LTS: coturn</p> <p>Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user&#39;s credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim&#39;s quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker&#39;s session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker&#39;s own identity rather than the allocation owner&#39;s. This issue is fixed in version 4.15.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65981