{"id":"CVE-2026-68554","summary":"Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.","aliases":["GHSA-5538-7cxj-5jcc"],"modified":"2026-09-11T08:36:44.321143Z","published":"2026-08-19T20:38:28.419Z","related":["openSUSE-SU-2026:11617-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68554.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-345","CWE-924"]},"references":[{"type":"WEB","url":"https://github.com/coturn/coturn/releases/tag/4.15.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68554.json"},{"type":"ADVISORY","url":"https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68554"},{"type":"FIX","url":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coturn/coturn","events":[{"introduced":"0"},{"fixed":"ab762f334f511ea37ab4b703a47d5d683a5be978"},{"fixed":"ac6a9633b16a1a35ab248570484e52d138515ad5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.15.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["docker/4.14.0-r0","4.14.0","docker/4.13.1-r0","docker/4.13.0-r0","4.13.1","4.13.0","docker/4.12.0-r0","4.12.0","docker/4.11.0-r0","4.11.0","docker/4.10.0-r1","docker/4.10.0-r0","4.10.0","docker/4.9.0-r0","4.9.0","docker/4.8.0-r1","docker/4.8.0-r0","4.8.0","docker/4.7.0-r4","docker/4.7.0-r3","docker/4.7.0-r2","docker/4.7.0-r1","docker/4.7.0-r0","4.7.0","docker/4.6.3-r3","docker/4.6.3-r2","docker/4.6.3-r1","docker/4.6.3-r0","4.6.3","docker/4.6.2-r13","docker/4.6.2-r12","docker/4.6.2-r11","docker/4.6.2-r10","docker/4.6.2-r9","docker/4.6.2-r8","docker/4.6.2-r7","docker/4.6.2-r6","docker/4.6.2-r5","docker/4.6.2-r4","docker/4.6.2-r3","docker/4.6.2-r2","docker/4.6.2-r1","docker/4.6.2-r0","4.6.2","docker/4.6.1-r3","docker/4.6.1-r2","docker/4.6.1-r1","docker/4.6.1-r0","docker/4.6.0-r1","docker/4.6.0-r0","4.6.0","docker/4.5.2-r14","docker/4.5.2-r13","docker/4.5.2-r12","docker/4.5.2-r11","docker/4.5.2-r10","docker/4.5.2-r9","docker/4.5.2-r8","docker/4.5.2-r7","docker/4.5.2-r6","docker/4.5.2-r0","4.5.2","4.5.1.3","4.5.1.2","4.5.1.1","4.5.1.0","4.5.0.7","4.5.0.6","4.5.0.5","4.5.0.4","4.5.0.3","4.5.0.2","4.5.0.1","4.4.5.4","4.4.5.3"],"database_specific":{"vanir_signatures_modified":"2026-09-11T08:36:44Z","vanir_signatures":[{"target":{"file":"src/client/ns_turn_msg.h"},"deprecated":false,"digest":{"line_hashes":["187607345595131467902693838462308306752","72002147926325709036944611097215255428","25756305666713704789275818757194638155","263440164181219378724845800478742993734"],"threshold":0.9},"id":"CVE-2026-68554-2c4b5542","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978"},{"source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"tests/test_stun_msg.c","function":"main"},"deprecated":false,"digest":{"function_hash":"41643669894682188215094192734999739723","length":1390},"id":"CVE-2026-68554-68076039","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/client/ns_turn_msg.c"},"deprecated":false,"digest":{"line_hashes":["15871114836253548318662383286331414963","298880985427035940686424378638557042449","295304558891554527111223066887222301419"],"threshold":0.9},"id":"CVE-2026-68554-6aeac0a4","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["119868789062684038076780377334397840958","127944157914558355018717680925014055619","207845877431562762415141707443052002303","173466160738353120640649015418801402838","130264786424818480905268558415513475544","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","129650714188928319433322190275339965204","69509710144120563558818407051624818135","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","202661468279049185819036880291725954750","128070972249786445507408225435366325745","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","202661468279049185819036880291725954750","128070972249786445507408225435366325745","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","202661468279049185819036880291725954750","128070972249786445507408225435366325745","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","202661468279049185819036880291725954750","128070972249786445507408225435366325745","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","202661468279049185819036880291725954750","128070972249786445507408225435366325745","160699826502064847153740675057190707354","188498266505800062820506194427657309265","313195527747018159136669519852929186555","256707401688654530629271838531912110626","191284267879359825927312182199866908628","215620217147277757356951572598498271302","188498266505800062820506194427657309265","313195527747018159136669519852929186555","53597120919103635726294934715965370276","97686129899414388758967660024117526569","173205682747106853742074059494550555041","111783162366610146571522764805534515201","202767485279707690909045721526893904220","247544072810209847612899370230803679022","294626348394847509623572290731359510505","120264278195565615155804568365548047310","303937136975523773308155065858366886463","202767485279707690909045721526893904220","118644154901063452926503856084123392954","184255186906293936257639342915725686501","141814230768592929624385416510113607195","303937136975523773308155065858366886463","202767485279707690909045721526893904220","53597120919103635726294934715965370276","84505916145337152588527072005426044791"],"threshold":0.9},"id":"CVE-2026-68554-80f0f668","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/server/ns_turn_server.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"tests/test_stun_msg.c"},"deprecated":false,"digest":{"line_hashes":["204264647642819134279468588358761980031","151486431553365481736026869398605468319","145426058790275659148002931451883319750","119677661815412017462069349365727237742","238603036093953884163760840419892657312","161461567659262211115797072116247587856"],"threshold":0.9},"id":"CVE-2026-68554-956e0590","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/apps/common/stun_buffer.h"},"deprecated":false,"digest":{"line_hashes":["145491667071940271992096766684929412445","331074818928952310801444993394345296731","86091485466025133790736394720457652458","185297468745095198454760359449943616142"],"threshold":0.9},"id":"CVE-2026-68554-9eebd13e","signature_type":"Line"},{"digest":{"line_hashes":["233924538414574426215604600836200853978","213591367050566838669431551940691013636","260830174164741497206814035696001588167","323124196554172250270967826065697233890"],"threshold":0.9},"id":"CVE-2026-68554-c8274d27","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/apps/uclient/startuclient.c"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["11432378877426092216101978059817140434","305743017230572670308332177981904421711","169701836712138994926500645964312129732","82017588760602730439941985218095933532","11432378877426092216101978059817140434","305743017230572670308332177981904421711","334370432304838505799266541293297406917","186817433119114874629248419544529833212"]},"id":"CVE-2026-68554-d2edea0a","signature_type":"Line","signature_version":"v1","source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/apps/uclient/uclient.c"}},{"source":"https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978","target":{"file":"src/apps/common/stun_buffer.c"},"deprecated":false,"digest":{"line_hashes":["125122199530685286022081423195708142768","333903053368523609292492231427845815579","58056794171469991762277780672815423501"],"threshold":0.9},"id":"CVE-2026-68554-e6626d6d","signature_type":"Line","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68554.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}