CVE-2026-68555

Name of the Vulnerable Software and Affected Versions Coturn version 4.15.0

Description An authenticated TURN user can repeatedly resume a single allocation from new UDP 5-tuples without completing a handoff when the server has the --mobility feature enabled. This occurs because the mobile begin transition() function in src/server/ns turn server.c disarms the allocation timeout for each new session and overwrites the mobile pending resume link, making previous pending sessions unreachable by the cleanup process. Additionally, the copy auth parameters() function ignores failures from inc quota(). Consequently, an attacker can maintain an unlimited number of server-side sessions, leading to process memory exhaustion, even if --user-quota=1 is configured.

Recommendations Update Coturn to version 4.16.0. As a temporary mitigation, disable the --mobility feature.