CVE-2026-43915

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

• CWE-79

• https://github.com/coturn/coturn/releases/tag/4.11.0Release Notes
• https://github.com/coturn/coturn/security/advisories/GHSA-xxf5-9vj2-g84jVendor Advisory

Published

Jun 18, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4391A security vulnerability has been detected in TeamSpeak 3 Se…6.9
• CVE-2026-43910Appium Java Client is the Java language binding for writing …8.2
• CVE-2026-43911Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43912Vaultwarden is a Bitwarden-compatible server written in Rust…8.7
• CVE-2026-43913Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43914Vaultwarden is a Bitwarden-compatible server written in Rust…9.8
• CVE-2026-43916pam_authnft is a PAM session module binding nftables firewal…8.7
• CVE-2026-43917Dokploy is a free, self-hostable Platform as a Service (PaaS…5.3
• CVE-2026-43918FOSSBilling is a free, open-source billing and client manage…8.7
• CVE-2026-43919Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-4392A vulnerability was detected in TeamSpeak 3 Server up to 3.1…6.9
• CVE-2026-43920FOSSBilling is a free, open-source billing and client manage…6.9