Every CVE Search/ Get API key

CVE-2026-43915

Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username

5.4 MediumFix available

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.24%Up 0.2 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
CVE-2026-43915
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-37939 5.4

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
EUVD-2026-37939
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
NVD 5.4

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
CVE-2026-43915
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
CVE-2026-43915
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-43915 5.4

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
DEBIAN-CVE-2026-43915
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-43915 5.4

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

Record
UBUNTU-CVE-2026-43915
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:11617-1 No score

coturn-4.17.2-1.1 on GA media

These are all security issues fixed in the coturn-4.17.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11617-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
coturn
Debian:12
 All versions, plus listed versions
4.12.0-14.14.0-14.15.0-14.18.0-14.6.1-14.6.1-2
 None known
coturn
Debian:13
 All versions, plus listed versions
4.12.0-14.14.0-14.15.0-14.18.0-14.6.1-2
 None known
coturn
Debian:14
 before 4.12.0-1, plus listed versions
4.6.1-2
4.12.0-1
coturn
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.4.5.4-24.5.0.2-34.5.0.3-14.5.0.3-1build14.5.0.3-1ubuntu0.24.5.0.3-1ubuntu0.34.5.0.3-1ubuntu0.4
 None known
coturn
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.5.0.6-1ubuntu24.5.0.7-1ubuntu14.5.0.7-1ubuntu24.5.0.7-1ubuntu2.18.04.14.5.0.7-1ubuntu2.18.04.24.5.0.7-1ubuntu2.18.04.3
 None known
coturn
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.5.1.1-1.1build14.5.1.1-1.1build24.5.1.1-1.1ubuntu0.20.04.14.5.1.1-1.1ubuntu0.20.04.2
 None known
coturn
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.5.2-34.5.2-3.1~ubuntu22.04.1
 None known
coturn
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.6.1-1build14.6.1-1build24.6.1-1build34.6.1-1build4
 None known
coturn
Ubuntu:25.10
 All versions, plus listed versions
4.6.1-2build1
 None known
coturn
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.6.1-2build14.6.1-2build2
 None known
coturn
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 4.17.2-1.1
4.17.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43915 is a medium vulnerability (CVSS 5.4) in Coturn, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in coturn 4.12.0-1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open