Coturn: Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the… (CVE-2026-68554)

Coturn, an open source TURN and STUN server, prior to version 4.15.0, is vulnerable to an on-path attack where an attacker can append attributes after the MESSAGE-INTEGRITY attribute in an authenticated STUN request sent over plain UDP or TCP. The attacker can adjust the STUN header length and recompute the unkeyed FINGERPRINT attribute, which does not cover the entire message, allowing the original HMAC to remain valid. This flaw allows server-side parsing to continue beyond the MESSAGE-INTEGRITY attribute, enabling the injection or modification of attributes such as LIFETIME, XOR-PEER-ADDRESS, or ORIGIN. These manipulations can override allocation lifetimes, inject permissions, or bypass origin checks. The vulnerability does not affect deployments using TLS or DTLS, which prevent in-transit modification. The issue is resolved in version 4.15.0.

An attacker positioned on the network path can modify authenticated STUN requests by appending attributes after the MESSAGE-INTEGRITY attribute without invalidating the HMAC. This can lead to unauthorized extension of allocation lifetimes, injection of permissions, or bypassing origin checks on the server. The vulnerability affects only plain UDP or TCP communications and does not impact TLS or DTLS secured deployments.

Upgrade Coturn to version 4.15.0 or later where this vulnerability is fixed. Deployments using TLS or DTLS are not vulnerable to this issue. No additional mitigation is required if TLS/DTLS is in use.