← Vulnerability feed

Vulnerability record · CVE-2018-4059 · published 21 March 2019

CVE-2018-4059: Coturn project coturn missing authorization vulnerability

Coturn Project · Coturn

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

9.8 CVSS 3.1 Critical EPSS 1.9% · top 21.2% CWE-862 · Missing authorization
9.8CVSS 3.1 base score, v2 10.0
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0733 MitigationThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0733 MitigationThird Party Advisory

Track CVE-2018-4059 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-43994Coturn project coturn classic buffer overflow vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_g…EPSS 0.68%9.8CVE-2020-6061Coturn project coturn out-of-bounds read vulnerabilityAn exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST …EPSS 5.1%9.8CVE-2018-4056Coturn project coturn sql injection vulnerabilityAn exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a…EPSS 3.0%7.7CVE-2018-4058Coturn project coturn vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN se…EPSS 0.92%7.5CVE-2026-40613Coturn project coturn vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform uns…EPSS 1.5%7.5CVE-2020-4067Coturn project coturn vulnerabilityIn coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information bet…EPSS 1.9%7.5CVE-2020-6062Coturn project coturn null pointer dereference vulnerabilityAn exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST reques…EPSS 6.1%7.4CVE-2026-53450Coturn project coturn server-side request forgery (ssrf) vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-…EPSS 0.29%

Source: NIST National Vulnerability Database (record CVE-2018-4059), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.