CVE-2026-55663: CWE-345: Insufficient Verification of Data Authenticity in versatica mediasoup

The mediasoup WebRTC video conferencing system's SCTP stack in versions 3.20.0 to 3.20.6 (npm) and 0.22.0 to 0.22.5 (Rust crate) authenticates state cookies using only hardcoded magic values (msworker and 0xAD81) rather than a per-instance secret and HMAC as required by RFC 9260 Section 5.1.3. This flaw allows an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and lacking DTLS protection to forge a COOKIE-ECHO packet with a verification tag controlled by the attacker. The forged cookie passes internal validation functions, leading to unauthorized SCTP association establishment and permitting injection of DataChannel messages as a trusted peer. The WebRtcTransport is unaffected because its SCTP runs inside DTLS, which provides protection. The vulnerability is addressed in npm version 3.20.6 and Rust crate version 0.22.5.

An attacker positioned on the network path can forge SCTP COOKIE-ECHO packets to establish unauthorized SCTP associations with mediasoup servers using PlainTransport or PipeTransport without DTLS. This unauthorized association allows the attacker to inject DataChannel messages as if they were a trusted peer, potentially leading to data integrity and confidentiality issues. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS score of 5.6. WebRtcTransport users are not affected due to DTLS protection.

Upgrade mediasoup to npm version 3.20.6 or later, or Rust crate version 0.22.5 or later, where this vulnerability is fixed. Avoid using PlainTransport or PipeTransport with SCTP enabled without DTLS protection. Since the vendor has provided official fixes, applying these updates is the recommended remediation.