{"id":"UBUNTU-CVE-2026-65981","details":"Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.","modified":"2026-08-06T00:23:22Z","published":"2026-07-31T21:17:00Z","upstream":["CVE-2026-65981"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-65981"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-65981"},{"type":"REPORT","url":"https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8"},{"type":"REPORT","url":"https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05"}],"affected":[{"package":{"name":"coturn","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.5.4-2","4.5.0.2-3","4.5.0.3-1","4.5.0.3-1build1","4.5.0.3-1ubuntu0.2","4.5.0.3-1ubuntu0.3","4.5.0.3-1ubuntu0.4"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.5.0.3-1ubuntu0.4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}},{"package":{"name":"coturn","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.0.6-1ubuntu2","4.5.0.7-1ubuntu1","4.5.0.7-1ubuntu2","4.5.0.7-1ubuntu2.18.04.1","4.5.0.7-1ubuntu2.18.04.2","4.5.0.7-1ubuntu2.18.04.3"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.5.0.7-1ubuntu2.18.04.3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}},{"package":{"name":"coturn","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1.1-1.1build1","4.5.1.1-1.1build2","4.5.1.1-1.1ubuntu0.20.04.1","4.5.1.1-1.1ubuntu0.20.04.2"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.5.1.1-1.1ubuntu0.20.04.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}},{"package":{"name":"coturn","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.2-3","4.5.2-3.1~ubuntu22.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.5.2-3.1~ubuntu22.04.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}},{"package":{"name":"coturn","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.1-1build1","4.6.1-1build2","4.6.1-1build3","4.6.1-1build4"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.6.1-1build4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}},{"package":{"name":"coturn","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/coturn?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.1-2build1","4.6.1-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"coturn","binary_version":"4.6.1-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65981.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"},{"type":"Ubuntu","score":"medium"}]}