CVE-2026-53448: Coturn: SQL Injection in HTTPS Admin Panel Delete Operations
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The issecurestring filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated admin can inject arbitrary SQL through the du, ds, and dip parameters, gaining full database control and potentially OS-level access via PostgreSQL COPY TO PROGRAM. This issue is fixed in version 4.12.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53448?
CVE-2026-53448 has a severity rating of high, with a score of 7.2.
What vulnerability does CVE-2026-53448 address?
CVE-2026-53448 addresses an SQL injection vulnerability in the HTTPS admin panel delete operations of Coturn.
How do I fix CVE-2026-53448?
To fix CVE-2026-53448, update to Coturn version 4.12.0 or later, where the vulnerability has been patched.
What are the potential risks of CVE-2026-53448?
CVE-2026-53448 could allow attackers to execute arbitrary SQL queries on the database used by Coturn due to improper sanitization.
Which software is affected by CVE-2026-53448?
CVE-2026-53448 affects the Coturn software, specifically versions prior to 4.12.0.