CVE-2018-4056: Coturn Project Coturn

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

Affected products

• Coturn Project Coturn: before 4.5.0.9 (fixed in 4.5.0.9)
• Debian Debian Linux: version 8.0 only; version 9.0 only

Published 2019-02-05. Last modified 2026-06-17.