CVE-2026-43915 Details
Description
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.
A stored cross-site scripting vulnerability has been identified in Coturn versions prior to 4.11.0. This issue resides in the web-admin HTTPS interface, where an attacker can inject HTML or JavaScript that executes when an authenticated admin user views the TURN session list. The vulnerability arises from insufficient input validation of the USERNAME value in TURN allocations, allowing malicious scripts to be embedded and later executed. In configurations with anonymous TURN access, exploitation may be possible without credentials, while authenticated deployments require valid TURN credentials or control over a provisioned username.
Users can upgrade to Coturn version 4.11.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coturn/coturn/releases/tag/4.11.0 | [email protected] | Release Notes |
| https://github.com/coturn/coturn/security/advisories/GHSA-xxf5-9vj2-g84j | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coturn project coturn | < 4.11.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |