CVE-2026-43915: Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username
Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.11.0 - Compensating control
If using anonymous TURN access (--no-auth), treat deployments as potentially exploitable without TURN credentials; restrict access to TURN allocations or use authenticated TURN credentials instead.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43915?
The severity of CVE-2026-43915 is classified as medium with a score of 5.4.
What type of vulnerability is CVE-2026-43915?
CVE-2026-43915 is a stored cross-site scripting (XSS) vulnerability found in the Coturn web-admin interface.
How do I fix CVE-2026-43915?
To fix CVE-2026-43915, upgrade to Coturn version 4.11.0 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-43915?
Users running Coturn versions prior to 4.11.0 are affected by CVE-2026-43915.
What can an attacker do with CVE-2026-43915?
An attacker can exploit CVE-2026-43915 to inject malicious HTML/JavaScript through a crafted TURN username in the web-admin interface.