CVE-2026-68554: Coturn STUN/TURN Authentication Bypass

CVE-2026-68554 Overview

Coturn is a widely deployed open source implementation of Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) servers. CVE-2026-68554 describes an integrity verification flaw [CWE-345] affecting Coturn releases prior to 4.15.0. An on-path attacker can append attributes after MESSAGE-INTEGRITY in an authenticated STUN request sent over plain UDP or TCP. The server continues parsing past the HMAC boundary, honoring trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes. This allows lifetime overrides, permission injection, and origin check bypass on authenticated sessions.

Critical Impact
On-path attackers can modify authenticated TURN allocations, inject peer permissions, or bypass origin checks against Coturn instances that accept plain UDP or TCP transports.

Affected Products

Coturn TURN/STUN server versions prior to 4.15.0
Deployments accepting plain UDP transport
Deployments accepting plain TCP transport

Discovery Timeline

2026-08-19 - CVE-2026-68554 published to NVD
2026-08-20 - Last updated in NVD database
Fixed in Coturn 4.15.0 - Patch merged via commit ab762f334f511ea37ab4b703a47d5d683a5be978

Technical Details for CVE-2026-68554

Vulnerability Analysis

The STUN protocol uses a keyed HMAC (MESSAGE-INTEGRITY) to authenticate request contents. The HMAC covers only the message prefix up to and including its own attribute. Coturn's server-side parser in src/server/ns_turn_server.c iterates all attributes present in the STUN header, including any that appear after MESSAGE-INTEGRITY. An attacker can append attributes, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid over the prefix. The parser routes trailing attributes through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), applying attacker-controlled values.

Root Cause

The root cause is missing enforcement of the MESSAGE-INTEGRITY coverage boundary during attribute iteration. Attributes outside the HMAC-protected region are treated as authenticated. The fix introduces stun_attr_get_next_covered(), which halts iteration once MESSAGE-INTEGRITY has been yielded so trailing attributes are ignored.

Attack Vector

Exploitation requires an adjacent network position on the path between client and server. Transport Layer Security (TLS) and Datagram TLS (DTLS) deployments prevent in-transit modification and are not affected. Plain UDP and TCP deployments allow the attacker to rewrite the STUN header length, append forged attributes such as LIFETIME (to extend or shrink allocation duration), XOR-PEER-ADDRESS (to inject a permission for an unauthorized peer), or ORIGIN (to bypass origin checks), and recalculate FINGERPRINT.

stun_attr_ref stun_attr_get_first(const stun_buffer *buf);
stun_attr_ref stun_attr_get_first_by_type(const stun_buffer *buf, uint16_t attr_type);
stun_attr_ref stun_attr_get_next(const stun_buffer *buf, stun_attr_ref prev);
/** stun_attr_get_next_covered_str() over a stun_buffer: stops once
 * MESSAGE-INTEGRITY has been yielded. Use when walking a message whose
 * integrity was checked, so trailing attributes outside the HMAC are ignored. */
stun_attr_ref stun_attr_get_next_covered(const stun_buffer *buf, stun_attr_ref prev);
// Source: https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978

The patch introduces a boundary-aware iterator so callers walking authenticated messages skip attributes beyond MESSAGE-INTEGRITY.

Detection Methods for CVE-2026-68554

Indicators of Compromise

STUN requests where the header length exceeds the offset of the MESSAGE-INTEGRITY attribute by more than the trailing FINGERPRINT size.
Unexpected LIFETIME changes on TURN allocations that were not initiated by the legitimate client.
Permissions installed for XOR-PEER-ADDRESS values that do not correspond to any observed client CreatePermission activity.
ORIGIN attribute values in requests that conflict with the TLS/authentication context of the session.

Detection Strategies

Inspect STUN traffic on UDP/3478 and TCP/3478 for messages containing attributes positioned after MESSAGE-INTEGRITY other than the standard FINGERPRINT.
Correlate TURN allocation lifetimes reported in Coturn logs against expected client behavior to identify anomalous refresh patterns.
Alert when Coturn versions below 4.15.0 are detected in software inventory data.

Monitoring Recommendations

Log all TURN allocation, refresh, and CreatePermission events with source address and origin attribute values for retrospective analysis.
Monitor network flow telemetry for unexpected peer connections that could indicate injected permissions.
Track version and configuration drift across Coturn deployments and flag hosts running plain UDP/TCP listeners without TLS/DTLS.

How to Mitigate CVE-2026-68554

Immediate Actions Required

Upgrade Coturn to version 4.15.0 or later on all TURN/STUN servers.
Prioritize upgrades on any instance that exposes plain UDP or TCP listeners to untrusted networks.
Audit existing allocations and permissions after upgrade to identify residual attacker-created state.

Patch Information

The fix is available in Coturn 4.15.0 and delivered through commit ab762f334f511ea37ab4b703a47d5d683a5be978. The patch adds stun_attr_get_next_covered() in src/apps/common/stun_buffer.c and stun_buffer.h, ensuring attribute iteration stops at MESSAGE-INTEGRITY. Full details are documented in GitHub Security Advisory GHSA-5538-7cxj-5jcc.

Workarounds

Restrict client connections to TLS (turns://) and DTLS transports, which cryptographically prevent in-transit modification.
Disable plain UDP (no-udp) and plain TCP (no-tcp) listeners in turnserver.conf where operationally feasible.
Place Coturn behind network segmentation that limits adjacent-network attacker positioning until the upgrade completes.

bash

# turnserver.conf - disable plaintext transports until upgraded
no-udp
no-tcp
# require TLS/DTLS with valid certificates
cert=/etc/coturn/certs/server.crt
pkey=/etc/coturn/certs/server.key
no-tlsv1
no-tlsv1_1