PT-2026-50779 · Coturn · Coturn

Kilhsrito-Crypto · Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-43915

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.11.0

Description A stored cross-site scripting (XSS) issue exists in the web-admin HTTPS interface. An attacker can inject HTML or JavaScript by creating a TURN allocation with a crafted USERNAME value. This script executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access via the --no-auth flag, this can be exploited without credentials. In authenticated deployments, the attacker requires valid TURN credentials or control over a provisioned username.

Recommendations Update to version 4.11.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43915

Affected Products

Coturn

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43915 · Security Note
• https://github.com/coturn/coturn/releases/tag/4.11.0 · Note
• https://github.com/coturn/coturn/security/advisories/GHSA-xxf5-9vj2-g84j · Note
• https://twitter.com/VulmonFeeds/status/2067752930061517222 · Twitter Post
• https://twitter.com/infoflowcloud/status/2067718027978723356 · Twitter Post
• https://twitter.com/CVEnew/status/2067717381447676199 · Twitter Post