Coturn is a widely deployed open-source STUN and TURN relay server used extensively in real-time communications infrastructure, including VoIP, video conferencing, and WebRTC applications. Vulnerabilities affecting the project skew strongly toward critical-severity outcomes and recur through weakness classes including confused-deputy issues, improper access control, SQL injection, and initialization flaws that reflect the authentication, authorization, and input-handling demands of a network intermediary. Defenders should prioritize patches for this vendor given its position in the communication stack and the severity tendency of its disclosures; live exploitation and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Coturn Project over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-43994CRITICAL Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len fiel | Jun 18, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-53450HIGH Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the defau | Jul 10, 2026 | 7.4 | 33 | NO | NO |
CVE-2018-4056CRITICAL An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can | Feb 5, 2019 | 9.8 | 32 | NO | NO |
CVE-2026-53448HIGH Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprin | Jul 10, 2026 | 7.2 | 31 | NO | NO |
CVE-2018-4059CRITICAL An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated | Mar 21, 2019 | 9.8 | 30 | NO | NO |
CVE-2026-53449MEDIUM Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passe | Jul 10, 2026 | 6.0 | 29 | NO | NO |
CVE-2026-40613HIGH Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform unsafe pointer casts from uint8_t | Apr 21, 2026 | 7.5 | 27 | NO | NO |
CVE-2020-6062HIGH An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to server crash and | Feb 19, 2020 | 7.5 | 27 | NO | NO |
CVE-2026-43915MEDIUM Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS inter | Jun 18, 2026 | 5.4 | 26 | NO | NO |
CVE-2020-6061CRITICAL An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to information | Feb 19, 2020 | 9.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Coturn Project.
Media articles that mention a CVE ID that affects a product developed by Coturn Project — matched by CVE ID, not by vendor name.