CVE-2026-53448

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.12.0

Description The HTTPS admin panel fails to sanitize HTTP query parameters before passing them into SQL queries using snprintf string interpolation. While the STUN protocol path is protected by the is secure string filter, this protection is missing from the delete-user, delete-secret, and delete-IP operations. Consequently, an authenticated administrator can perform SQL injection through the du, ds, and dip parameters. This can lead to complete database control and potential operating system-level access via the PostgreSQL COPY TO PROGRAM functionality.

Recommendations Update to version 4.12.0. As a temporary mitigation, restrict access to the HTTPS admin panel to trusted administrators only.