CVE-2026-65981

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker who obtains a victim MOBILITY-TICKET to receive and inject relayed traffic and consume the victim's quota. In the handle_turn_refresh resume branch, the victim allocation (orig_ss) is located solely by the attacker-controlled mobile id, and credentials are only adopted (via copy_auth_parameters) when the resuming session is unauthenticated. Because the attacker's session already has hmackey_set set to 1 from its own prior authentication (which is never reset for long-term-credential sessions), the credential copy is skipped and check_stun_auth validates the REFRESH against the attacker's own identity rather than the allocation owner's. This issue is fixed in version 4.15.0.

• CWE-639

• https://github.com/coturn/coturn/commit/37df0513168f830a7c9ce0a411db0300fa182f05
• https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8
• https://github.com/coturn/coturn/security/advisories/GHSA-69wx-x7x6-pjj8

Published

Jul 31, 2026

Last Modified

Aug 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65948UnixAuth lacks brute-force protection in Apache Ranger versi…7.3
• CVE-2026-6595A vulnerability was identified in ProjectsAndPrograms School…7.3
• CVE-2026-6596A security flaw has been discovered in langflow-ai langflow …7.3
• CVE-2026-6597A weakness has been identified in langflow-ai langflow up to…2.7
• CVE-2026-65975Pydantic AI is a Python agent framework for building applica…6.5
• CVE-2026-6598A security vulnerability has been detected in langflow-ai la…4.3
• CVE-2026-65986CVAT is an open source interactive video and image annotatio…8.5
• CVE-2026-6599A vulnerability was detected in langflow-ai langflow up to 1…6.3
• CVE-2026-6600A flaw has been found in langflow-ai langflow up to 1.8.3. T…3.5
• CVE-2026-66000Frappe is a full-stack web application framework. Prior to 1…2.3
• CVE-2026-66004BlenderMCP before commit 30a3308 contains a path traversal v…6
• CVE-2026-66005Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS …6.3