CVE-2026-65981: Coturn Auth Bypass Vulnerability

CVE-2026-65981 Overview

Coturn is a free open-source implementation of Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) servers. Versions prior to 4.15.0 running with the --mobility option fail to bind a resumed REFRESH request to the original allocation owner. An authenticated attacker who obtains a victim's MOBILITY-TICKET can hijack the allocation, inject or receive relayed traffic, and consume the victim's quota. The flaw resides in the handle_turn_refresh resume branch, where credential adoption is skipped for already-authenticated sessions. This issue is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key] and is fixed in coturn 4.15.0.

Critical Impact
An authenticated attacker holding a leaked MOBILITY-TICKET can take over another user's TURN allocation, relay traffic on their behalf, and exhaust their quota.

Affected Products

coturn TURN/STUN server versions prior to 4.15.0
Deployments running with the --mobility option enabled
Long-term-credential authenticated coturn sessions

Discovery Timeline

2026-07-31 - CVE CVE-2026-65981 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-65981

Vulnerability Analysis

Coturn's mobility feature allows a client to migrate an existing TURN allocation to a new 5-tuple by presenting a MOBILITY-TICKET in a REFRESH request. The server locates the original allocation state (orig_ss) using the attacker-controlled mobile id contained in the ticket. Before the patch, the resuming session's credentials were adopted from the original owner only when the resuming session was itself unauthenticated. Because long-term-credential sessions retain hmackey_set = 1 from their prior authentication, the credential-copy step is bypassed, and check_stun_auth validates the REFRESH against the attacker's own username, realm, and HMAC key rather than the allocation owner's. The result is a checked authorization decision made against the wrong identity.

Root Cause

The defect is a classic authorization bypass through a user-controlled key [CWE-639]. The mobile id supplied in the MOBILITY-TICKET selects which allocation to resume, but the server never enforces that the requester's authenticated identity matches the identity that created the allocation. Gating copy_auth_parameters(orig_ss, ss) on !(ss->hmackey_set) created a code path where an authenticated attacker's credentials silently override the intended validation.

Attack Vector

Exploitation requires network access to the TURN server, valid long-term credentials for any account, and possession of a victim MOBILITY-TICKET. The attacker authenticates normally, then sends a REFRESH containing the victim's mobile id. Coturn resolves orig_ss to the victim's allocation, skips credential adoption because hmackey_set is already set, and validates the REFRESH's MESSAGE-INTEGRITY against the attacker's own key. The attacker inherits control of the allocation and can send or receive relayed traffic under the victim's quota.

// Patch: src/server/ns_turn_server.c
// Fix: bind mobility session-resume to the original allocation owner (#1969)
            // Check security:
            int postpone_reply = 0;

-            if (!(ss->hmackey_set)) {
-              copy_auth_parameters(orig_ss, ss);
-            }
+            // A mobility resume must be authorized by the ORIGINAL allocation's
+            // owner. Unconditionally adopt the original session's credentials so
+            // that check_stun_auth() below verifies this REFRESH's
+            // MESSAGE-INTEGRITY (and USERNAME/REALM) against the original owner's
+            // key. Gating this on the resuming session being unauthenticated let
+            // an already-authenticated session be validated against its own
+            // credentials rather than the resumed allocation's owner.
+            copy_auth_parameters(orig_ss, ss);

            if (check_stun_auth(server, ss, tid, resp_constructed, err_code, reason, in_buffer, nbh,
                                STUN_METHOD_REFRESH, &message_integrity, &postpone_reply, can_resume) < 0) {

Source: GitHub commit 37df0513. The fix removes the conditional and unconditionally copies the original owner's authentication parameters before check_stun_auth runs.

Detection Methods for CVE-2026-65981

Indicators of Compromise

REFRESH requests where the authenticated username in the STUN USERNAME attribute does not match the username that created the referenced allocation.
A single TURN allocation being addressed from two distinct 5-tuples in short succession using different long-term credentials.
Unexpected spikes in a user's relay quota consumption without corresponding client activity.
Coturn log entries showing successful REFRESH handling immediately after a mobility resume from a new peer address.

Detection Strategies

Correlate coturn session and allocation log lines by mobile id and flag mismatches between the allocation owner and the authenticating principal on REFRESH.
Deploy network detections for STUN/TURN traffic that observe unexpected changes in the source address associated with a stable allocation id.
Baseline per-user relay bandwidth and alert on deviations that coincide with mobility resume events.

Monitoring Recommendations

Enable verbose coturn logging (--verbose) and centralize logs for correlation of USERNAME, realm, and mobile-ticket identifiers.
Monitor the coturn process version banner across the fleet to identify hosts still running versions earlier than 4.15.0.
Track authentication failure rates on STUN MESSAGE-INTEGRITY checks around REFRESH events, since attackers probing tickets may generate anomalies.

How to Mitigate CVE-2026-65981

Immediate Actions Required

Upgrade all coturn instances to version 4.15.0 or later, which unconditionally validates REFRESH messages against the original allocation owner.
Rotate long-term credentials for any account that may have handled sensitive relayed traffic on affected servers.
Audit historical logs for REFRESH requests whose authenticated user differs from the allocation owner.

Patch Information

The fix is delivered in coturn 4.15.0 via commit 37df0513168f830a7c9ce0a411db0300fa182f05. Additional context is available in the GitHub Security Advisory GHSA-69wx-x7x6-pjj8. The change in src/server/ns_turn_server.c removes the !(ss->hmackey_set) gate around copy_auth_parameters, ensuring check_stun_auth always evaluates against the original owner's key.

Workarounds

Disable the mobility feature by removing the --mobility flag from the coturn configuration until the upgrade is complete.
Restrict TURN server access to trusted networks or authenticated VPN peers to reduce the attacker population that can present tickets.
Shorten credential lifetimes and enforce per-user allocation quotas to limit blast radius if a ticket is leaked.

bash

# Example: disable mobility as a temporary workaround in turnserver.conf
# (Remove or comment out the mobility directive, then restart the service.)
# mobility
sudo sed -i 's/^mobility/#mobility/' /etc/turnserver.conf
sudo systemctl restart coturn

# Verify version after upgrade
turnserver -h | head -n 1   # expect: >= 4.15.0