CVE-2026-53448 Details
Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.
A SQL injection vulnerability has been identified in the Coturn TURN and STUN server implementation, affecting versions prior to 4.12.0. The issue arises in the HTTPS admin panel, where HTTP query parameters are passed directly into SQL queries via snprintf string interpolation without proper sanitization. This vulnerability allows an authenticated admin to inject arbitrary SQL through the delete-user, delete-secret, and delete-IP parameters. Exploitation of this vulnerability could lead to full database control and potentially OS-level access via PostgreSQL's COPY TO PROGRAM feature.
Users can upgrade to Coturn version 4.12.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coturn/coturn/security/advisories/GHSA-v8hj-2xx7-xmp5 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/coturn/coturn/commit/b84dbab1d1aa6e2bf0211a1cdbb250d6de2a0d09 | [email protected] | Patch |
| https://github.com/coturn/coturn/pull/1924 | [email protected] | Issue TrackingPatch |
| https://github.com/coturn/coturn/releases/tag/4.12.0 | [email protected] | Release Notes |
| https://github.com/coturn/coturn/security/advisories/GHSA-v8hj-2xx7-xmp5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coturn project coturn | < 4.12.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |