Coturn, an open source TURN and STUN server, prior to version 4.15.0, has a vulnerability when using the --mobility option. The server authenticates resumed REFRESH requests using the resuming user's credentials but fails to verify that these credentials match the original allocation owner. Specifically, in the handle_turn_refresh resume branch, the victim allocation is identified solely by the attacker-controlled mobile ID, and credential copying is skipped if the attacker's session is already authenticated. As a result, the server validates the REFRESH request against the attacker's own identity rather than the victim's, allowing an attacker with a valid MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. This flaw is resolved in version 4.15.0.

An authenticated attacker who obtains a victim's MOBILITY-TICKET can impersonate the victim's session to receive and inject relayed traffic and consume the victim's allocated quota. This compromises confidentiality and integrity of the victim's TURN allocations and causes resource exhaustion. The vulnerability has a CVSS 3.1 score of 7.1 (medium severity) with network attack vector, high impact on confidentiality and integrity, and low impact on availability.

Upgrade Coturn to version 4.15.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 4.15.0. Users running affected versions should apply this official fix to prevent exploitation.