CVE catalog

CVE-2026-53448

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolat

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancoturnsid4.18.0-1fixed
Debiancoturnforky4.18.0-1fixed
Debiancoturntrixie4.6.1-2vulnerable
Debiancoturnbookworm4.6.1-1vulnerable
CpecoturnNot reportedNot reportedvulnerable
Ubuntucoturn16.044.4.5.4-2vulnerable
Ubuntucoturn16.044.5.0.2-3vulnerable
Ubuntucoturn16.044.5.0.3-1vulnerable
Ubuntucoturn16.044.5.0.3-1build1vulnerable
Ubuntucoturn16.044.5.0.3-1ubuntu0.2vulnerable
Ubuntucoturn16.044.5.0.3-1ubuntu0.3vulnerable
Ubuntucoturn16.044.5.0.3-1ubuntu0.4vulnerable
Ubuntucoturn18.044.5.0.6-1ubuntu2vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu1vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2.18.04.1vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2.18.04.2vulnerable
Ubuntucoturn18.044.5.0.7-1ubuntu2.18.04.3vulnerable
Ubuntucoturn20.044.5.1.1-1.1build1vulnerable
Ubuntucoturn20.044.5.1.1-1.1build2vulnerable
Ubuntucoturn20.044.5.1.1-1.1ubuntu0.20.04.1vulnerable
Ubuntucoturn20.044.5.1.1-1.1ubuntu0.20.04.2vulnerable
Ubuntucoturn22.044.5.2-3vulnerable
Ubuntucoturn22.044.5.2-3.1~ubuntu22.04.1vulnerable
Ubuntucoturn24.044.6.1-1build1vulnerable
Ubuntucoturn24.044.6.1-1build2vulnerable
Ubuntucoturn24.044.6.1-1build3vulnerable
Ubuntucoturn24.044.6.1-1build4vulnerable
Ubuntucoturn26.044.6.1-2build1vulnerable
Ubuntucoturn26.044.6.1-2build2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancoturnsourcesid4.12.0-1not yet assignedNot reportedNot reported
Debiancoturnsourceforky4.12.0-1not yet assignedNot reportedNot reported
Debiancoturnsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancoturnsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [coturn]Affected
    Details (2)

    • 4.6.1-1 · amd64 · bookworm

      Affected

      nvd · coturn · debian · bookworm; nvd · coturn · debian · 12

    • 4.6.1-1 · arm64 · bookworm

      Affected

      nvd · coturn · debian · bookworm; nvd · coturn · debian · 12

[Debian 13 (Trixie)]

  • [coturn]Affected

    Source package: [coturn]

    Details (2)

    • 4.6.1-2 · amd64 · trixie

      Affected

      nvd · coturn · debian · 13

    • 4.6.1-2+b2 · arm64 · trixie

      Affected

      nvd · coturn · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]