{"id":"CVE-2026-55663","summary":"mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)","details":"mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.","aliases":["GHSA-p7x2-g5cq-fhmq"],"modified":"2026-08-27T19:14:09.385792Z","published":"2026-08-25T18:15:16.059Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55663.json"},"references":[{"type":"WEB","url":"https://github.com/versatica/mediasoup/releases/tag/3.20.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55663.json"},{"type":"ADVISORY","url":"https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55663"},{"type":"FIX","url":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"type":"FIX","url":"https://github.com/versatica/mediasoup/pull/1829"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/versatica/mediasoup","events":[{"introduced":"2d14dd510f638c45f70f02c4105be81c0391c7cc"},{"fixed":"9c1a90a8f9206b965e727d134846fb42df4980a7"},{"fixed":"5b71d9fa1c126ade85957da3dc061dc0f7b5f929"}],"database_specific":{"extracted_events":[{"introduced":"3.20.0"},{"fixed":"3.20.6"},{"introduced":"0.22.0"},{"fixed":"0.22.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["rust-0.22.4","3.20.5","rust-0.22.3","3.20.4","rust-0.22.2","3.20.3","rust-0.22.1","3.20.2","3.20.1","rust-0.22.0","3.20.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55663.json","vanir_signatures_modified":"2026-08-27T19:14:09Z","vanir_signatures":[{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/PlainTransport.cpp"},"deprecated":false,"digest":{"line_hashes":["98829289175053880522771808341491635189","334976016263829255909200647184232116947","259194469581646155334019087138409591016","124932897891561206029853231498428581039"],"threshold":0.9},"id":"CVE-2026-55663-01258563","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/StateCookie.cpp","function":"StateCookie::Dump"},"deprecated":false,"digest":{"function_hash":"36913893796356766402693352956679699750","length":830},"id":"CVE-2026-55663-0bc7c584"},{"digest":{"line_hashes":["112847289043841237084953971114131432823","25907530483282869698494742976576508744","317833580826811032142866418293599515205","35091263053218896231672884454170038361"],"threshold":0.9},"id":"CVE-2026-55663-0cda3bdb","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/public/SctpOptions.cpp"},"deprecated":false},{"target":{"file":"worker/src/RTC/PipeTransport.cpp"},"deprecated":false,"digest":{"line_hashes":["70527139793525657354795696423275329266","121206284009123228012707684711677570373","53950395188613287085513046525403350945","124932897891561206029853231498428581039"],"threshold":0.9},"id":"CVE-2026-55663-14b899f0","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"deprecated":false,"digest":{"line_hashes":["144148943044528390679563293280207934627","226715123979774486126488756320861062569","315279827824524581840716257489830541876","316637934413157018256342356962512689034"],"threshold":0.9},"id":"CVE-2026-55663-20c41dd5","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/include/RTC/SCTP/packet/parameters/StateCookieParameter.hpp"}},{"target":{"file":"worker/src/RTC/PipeTransport.cpp","function":"PipeTransport::PipeTransport"},"deprecated":false,"digest":{"function_hash":"194840865972559677020801961199246750146","length":3123},"id":"CVE-2026-55663-2e6be999","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"target":{"file":"worker/src/RTC/SCTP/association/Association.cpp"},"deprecated":false,"digest":{"line_hashes":["80138330122675069543991385756521971720","214002479522661428745562492447780756189","100897909588273043187583439665712365744","34491774435410228986169499037182694527","50874548559911680047507215939453175529","322674495673712208693649190142452832874","72377880176160906851734856077218835366","243290353588300788489850649027216236892","261391538999051189613199881843865915514","132654145478627593028204124339836556000","251447600124597579411596781948366662540","245707183663902088739976905818487914187","266384026559738818198496760374565151936","310729916360225316020297934501241303013","320948377172598679151610117320235034325","236685423649459555422383393952466945312","265641455067162974504018074774238188498","265693703299499021152600781479019557092","129953080658321932766144898599117209318","722516308522786207614478922285175120","34318065547961251546658787237335697304","99845376601932747060164225574077426490","317397307415496810597615667686084646192","109974962076194963740594012646853737867","221609708672108802212468395213526393580","16701412424673186517361435035468502097","22495760874321688071093347849531752388","156904682225593214729739430360708286758"],"threshold":0.9},"id":"CVE-2026-55663-312aa215","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/test/src/RTC/SCTP/association/TestAssociation.cpp"},"deprecated":false,"digest":{"line_hashes":["128622045745471573208711847318810573691","326982480226818781290613600412383657486","166325697506176218596577962519796477908","283711264008964776731896291366943096226"],"threshold":0.9},"id":"CVE-2026-55663-3e821e7d","signature_type":"Line","signature_version":"v1"},{"target":{"file":"worker/src/RTC/SCTP/association/Association.cpp","function":"Association::HandleReceivedCookieEchoChunk"},"deprecated":false,"digest":{"length":1987,"function_hash":"171932139782073914344294739240892738109"},"id":"CVE-2026-55663-3f3c9920","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"target":{"file":"worker/src/RTC/SCTP/public/SctpOptions.cpp","function":"SctpOptions::Dump"},"deprecated":false,"digest":{"length":3529,"function_hash":"143814765769549418678837473701664715671"},"id":"CVE-2026-55663-4763d56b","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"target":{"file":"worker/src/RTC/SCTP/packet/parameters/StateCookieParameter.cpp","function":"StateCookieParameter::WriteStateCookieInPlace"},"deprecated":false,"digest":{"function_hash":"325232548603709048077414778970572997797","length":420},"id":"CVE-2026-55663-4e4e8a08","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7"},{"digest":{"line_hashes":["48831292524149000834347942168696809786","236606325253955808530684522502620951001","271151562036079973257978567560047565642","192438749129613196868706352692945389611"],"threshold":0.9},"id":"CVE-2026-55663-5a1aa299","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/include/RTC/Transport.hpp"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/test/src/RTC/SCTP/association/TestStateCookie.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["327643466768994391230289605294502051916","276401892611270552976332018100318136060"]},"id":"CVE-2026-55663-62bf0d25","signature_type":"Line"},{"digest":{"function_hash":"322484769447792097568305042291256198593","length":549},"id":"CVE-2026-55663-6318c0ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/StateCookie.cpp","function":"StateCookie::IsMediasoupStateCookie"},"deprecated":false},{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/StateCookie.cpp","function":"StateCookie::Write"},"deprecated":false,"digest":{"function_hash":"52258147652522457501472968674383536688","length":1395},"id":"CVE-2026-55663-64f1da6b","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/Association.cpp","function":"Association::HandleReceivedInitChunk"},"deprecated":false,"digest":{"function_hash":"69246857365079760973454701082573234940","length":3691},"id":"CVE-2026-55663-652d3d9f","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/WebRtcTransport.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["180614762125227337943530616290738473646","73957687795482132904459938900300507603","213143239524597867418097717481641092056","24532689432168253955367009466006558032","74617752671763956373249847562222192816","215479042768502050699535447718317215197","226486236725297346071420305852913283148","93897817500326877153669619875734636821"]},"id":"CVE-2026-55663-6b0f10fd","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/Association.cpp","function":"mayConnectOnReceivedSctpData"},"deprecated":false,"digest":{"function_hash":"203184049052890519177121071560936904196","length":34},"id":"CVE-2026-55663-8369f2e4","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/include/RTC/SCTP/association/Association.hpp"},"deprecated":false,"digest":{"line_hashes":["298696620288709179067999906101689177852","5374148735990910301082394932960055499","44318596308086390203940260126188208981","197790315735746973523880853761260372735","277346844753094331996208216027093314804","18338153822195152405890438695104356035","152635144653391412819797495124330326067","55272184527750106183522775412722498901","39260383386756418403232578242316672010","30693982114971115596857671876103663314"],"threshold":0.9},"id":"CVE-2026-55663-866421d9","signature_type":"Line"},{"digest":{"function_hash":"298471806104954547463587955353964839027","length":1621},"id":"CVE-2026-55663-872cdc2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/Transport.cpp","function":"Transport::Transport"},"deprecated":false},{"digest":{"function_hash":"216279430732963865860992275319343500847","length":6011},"id":"CVE-2026-55663-99095d6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/PlainTransport.cpp","function":"PlainTransport::PlainTransport"},"deprecated":false},{"id":"CVE-2026-55663-a0d9b947","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/include/RTC/SCTP/association/StateCookie.hpp"},"deprecated":false,"digest":{"line_hashes":["85523180289611850088267335638899549956","309314890151852222112607039015754968664","127900175582463845242544808632756363946","73228062454903964411557049909870360636","2177215429275001984251348844217196903","177631243396967222808080704679614404628","190260815990355577969480155866269502873","209609498175558013105551809994688939275","30788378541876570748285061083675468918","294901410443700574702924698168062857280","306492346219772008700090335599706526159","24086839850845356292820946169086629165","169997491127493822814641696496762571164","174228159289108680701866301576397495021","161722975046834455107334763484743724799","23802477308186182952441013759848035194","300333481262432509515738963823703648964","144148943044528390679563293280207934627","143350946554431351770337253189992122545","250025753775270635764038954924827970627","148179200312450942516650325740203364834","144148943044528390679563293280207934627","61534630705491936378664674691000618396","183620880437442019308730128224929890220","200941489910554658060699049165771765053","284944097214751718461458423725419237657","51993580092398363820413650849507769846","170151454500349692951435041803984159865"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/packet/parameters/StateCookieParameter.cpp"},"deprecated":false,"digest":{"line_hashes":["214282456308859023245181039588263970623","43743963867328907768564625049796960260","204297911010607992010093995014637822090","12102770647400078498063449900176198354","180209813135484241889823890465652311205","328979770951463544286230039969017322333","108146574490390325823407252571968694872","233639335933483049107295098386876240410","191720414582331887658069347186549152880"],"threshold":0.9},"id":"CVE-2026-55663-aa62e3df"},{"deprecated":false,"digest":{"line_hashes":["235507674878531880494353677531813878710","162380995845586926257843871434418565296","19754437981740536465050154861052501430","69938891766850841954374491893756867106","249266053980434263965303436532065467106","233035695748896301647317383471311635610","87018261913833588477720870835155773484","324896556114378842159562530982150375455"],"threshold":0.9},"id":"CVE-2026-55663-b2ee474c","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/Transport.cpp"}},{"signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/DirectTransport.cpp","function":"DirectTransport::DirectTransport"},"deprecated":false,"digest":{"function_hash":"276764652198849391107314179178275346372","length":312},"id":"CVE-2026-55663-ba7c8532","signature_type":"Function"},{"id":"CVE-2026-55663-c2ebc7fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/StateCookie.cpp"},"deprecated":false,"digest":{"line_hashes":["178546703349014699725833211760002889638","189166129541791378723613378392844665866","304334683564783123225110228418994509974","45742374312019763630175881343598539487","152632603663456919084798972154438058763","172852967710306041393427921266864446355","262399495219319225050346645843502333418","78144914808564054988249505287888139618","224954304772437288267674735166345888367","220333672174510134597657551115730729032","243011536544168938542166048019127243741","318410902617915606683319936367861426869","222085048984831555089474955261975683597","212189121607579818999722952330063362601","10486370331734168425973662751643998755","316984613796024307747503623029366015766","336840724367405732056415593746226522601","126335771523772882831306867037967340920","216930972780106523590464766069995189350","281043452080619496591705729950571812735","109518212618659957029567575657392337688","105135349804760838859480469610730392589","246304193157919982296840929719933147639","122312092974972534731479797955931478633","25405441966234640313753631079011021659","214282456308859023245181039588263970623","43743963867328907768564625049796960260","204297911010607992010093995014637822090","127337292132834769140992045988851764133","180209813135484241889823890465652311205","209904659914503657066493470716791298722","254141052412587745616109970533213684094","248240771697591637247197697860284835110","89707116188411616303965006876070926030","214282456308859023245181039588263970623","43743963867328907768564625049796960260","204297911010607992010093995014637822090","286033949949690121535009199828004729933","287362746961954089901455857638266626765","81562474929016516127114706250881899921","263652038884653636656026585668212271847","141675542555219579262931526742329275015","237479563251325538155521293302415856818","64751216760251777823531098880048958230","287308481128705013463555576469809372710","241683949475448160905329252534671256923","107352710725565717323699341966628901435","64694386785654866263949818940638409005","67264459415396206370676306910666643435","163759393996033377356532670786968583265","275991335571254095914800848519272761754","259858924582743525877301678406209019353","96675361989865051514256759039714501462"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["265653477299632691356590846121168079656","181675777011482717341858558628896241137","115781947805955401093924268884870403189"]},"id":"CVE-2026-55663-c5075074","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/include/RTC/SCTP/public/SctpOptions.hpp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["168668416755001519147743633685560489977","73364499294950854851738943392813807092","55808408862481041101167640754683689226","254788992628144924887012615092220451177"],"threshold":0.9},"id":"CVE-2026-55663-ccd7efda","signature_type":"Line","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/DirectTransport.cpp"}},{"deprecated":false,"digest":{"function_hash":"216892858298529286604396052144773577788","length":158},"id":"CVE-2026-55663-e05cdc04","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/SCTP/association/StateCookie.cpp","function":"StateCookie::StateCookie"}},{"deprecated":false,"digest":{"length":4356,"function_hash":"56711877302816852154922322227063975078"},"id":"CVE-2026-55663-e46e97d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"file":"worker/src/RTC/WebRtcTransport.cpp","function":"WebRtcTransport::WebRtcTransport"}},{"deprecated":false,"digest":{"length":330,"function_hash":"198933588751313726210980872167530645928"},"id":"CVE-2026-55663-f8cb672f","signature_type":"Function","signature_version":"v1","source":"https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7","target":{"function":"StateCookie::Factory","file":"worker/src/RTC/SCTP/association/StateCookie.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}