CVE-2026-65981

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0

Description An authorization bypass exists in servers using the --mobility configuration. The system authenticates a resumed REFRESH request using the resuming user's credentials but fails to verify that identity against the original allocation owner. This occurs in the handle turn refresh resume branch, where the victim allocation (orig ss) is located using an attacker-controlled mobile id. Because the attacker's session may already have hmackey set enabled from prior authentication, the copy auth parameters process is skipped, and check stun auth validates the request against the attacker's identity instead of the owner's. An authenticated attacker who obtains a victim MOBILITY-TICKET can use this to receive and inject relayed traffic and consume the victim's quota.

Recommendations Update to version 4.15.0.