Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation requires valid TURN credentials or control over a provisioned username. This issue has been fixed in version 4.11.0.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c42d951aad advisory.

    # Coturn 4.13.1

    ## What's in this release
     - Security fixes

    ## What's Changed
     - Null-terminate `server_name` in `stun_is_challenge_response_str`
     - Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks
     - Auto-deny coturn's own database backend endpoints as relay peers
     - Deny link-local / ULA / site-local relay peers by default

    # Coturn 4.13.0

    ## What's in this release
     - More performance improvements for `--udp-recvmmsg` and `--multiplex-peer`. If your system does not rely     on TURN unique ports give multiplexing a try - it has capacity to dramatically increase performance.
     - Security fixes

    ## What's Changed
     - Wrap atomic everywhere
     - Fix `sendmmsg` stride bug in multiplex-peer UDP batch flush
     - Reap TURN permissions/channels via a per-thread sweep instead of per-object timers
     - Add `--udp-sendmmsg-log` to observe egress sendmmsg/UDP-GSO batching
     - Expose `recvmmsg`/`sendmmsg` UDP batch sizes as Prometheus metrics
     - Restrict `recvmmsg` fast path to shared fan-in sockets (make `--udp-recvmmsg` useful standalone)
     - Enable `--udp-recvmmsg` by default on Linux
     - Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time     compare, OAuth bounds checks, permission cap
     - Add continuous latency mode to stunclient
     - Fix test_redis_format link failure
     - Fix configure MANPREFIX typo
     - Fix missing sqlite3 dependendcy
     - Fix UDP receive buffer ownership


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dda1360c18 advisory.

    # Coturn 4.13.1

    ## What's in this release
     - Security fixes

    ## What's Changed
     - Null-terminate `server_name` in `stun_is_challenge_response_str`
     - Canonicalize all IPv4-in-IPv6 encodings before peer-IP checks
     - Auto-deny coturn's own database backend endpoints as relay peers
     - Deny link-local / ULA / site-local relay peers by default

    # Coturn 4.13.0

    ## What's in this release
     - More performance improvements for `--udp-recvmmsg` and `--multiplex-peer`. If your system does not rely     on TURN unique ports give multiplexing a try - it has capacity to dramatically increase performance.
     - Security fixes

    ## What's Changed
     - Wrap atomic everywhere
     - Fix `sendmmsg` stride bug in multiplex-peer UDP batch flush
     - Reap TURN permissions/channels via a per-thread sweep instead of per-object timers
     - Add `--udp-sendmmsg-log` to observe egress sendmmsg/UDP-GSO batching
     - Expose `recvmmsg`/`sendmmsg` UDP batch sizes as Prometheus metrics
     - Restrict `recvmmsg` fast path to shared fan-in sockets (make `--udp-recvmmsg` useful standalone)
     - Enable `--udp-recvmmsg` by default on Linux
     - Security hardening: port parsing, admin brute-force throttle, credential log redaction, constant-time     compare, OAuth bounds checks, permission cap
     - Add continuous latency mode to stunclient
     - Fix test_redis_format link failure
     - Fix configure MANPREFIX typo
     - Fix missing sqlite3 dependendcy
     - Fix UDP receive buffer ownership


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a     stored cross-site scripting (XSS) vulnerability in the web-admin HTTPS interface. An attacker who can     create a TURN allocation with a crafted USERNAME value can inject HTML/JavaScript that executes when an     authenticated web-admin user views the TURN session list. In configurations using anonymous TURN access     (--no-auth), this may be exploitable without TURN credentials. In authenticated deployments, exploitation     requires valid TURN credentials or control over a provisioned username. This issue has been fixed in     version 4.11.0. (CVE-2026-43915)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322359	Fedora 43 : coturn (2026-c42d951aad)	Nessus	Fedora Local Security Checks	medium
322356	Fedora 44 : coturn (2026-dda1360c18)	Nessus	Fedora Local Security Checks	medium
321776	Linux Distros Unpatched Vulnerability : CVE-2026-43915	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-43915

medium

Tenable Plugins

medium

medium

medium