CVE-2026-65981 Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover
An authenticated attacker can hijack another user's TURN allocation by exploiting a missing identity check during session resumption with mobility tickets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65981?
CVE-2026-65981 is a high-severity authentication bypass vulnerability in coturn, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-65981?
How do I fix CVE-2026-65981?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-65981 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65981 exists.
Sources
Also known as DEBIAN-CVE-2026-65981, GHSA-69wx-x7x6-pjj8, UBUNTU-CVE-2026-65981.