Coturn versions prior to 4.11.0 contain a stored cross‑site scripting flaw in the web‑admin HTTPS interface where a crafted TURN username can inject arbitrary HTML or JavaScript. When an authenticated web‑admin user views the session list, the malicious payload executes in the admin’s browser, potentially exposing credentials or allowing further exploitation. This weakness is a classic input validation flaw (CWE‑79).

The affected product is the Coturn TURN/STUN server (coturn:coturn). All releases older than 4.11.0 are vulnerable, while 4.11.0 and later contain the fix.

The CVSS score of 5.4 indicates a moderate risk. EPSS information is not available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to create a TURN allocation with a malicious USERNAME value. In configurations that allow anonymous access (using the --no‑auth flag), the flaw can be triggered without any credentials; otherwise valid TURN credentials or controlled usernames are necessary. Once the payload runs, it can execute arbitrary code in the context of the web‑admin, enabling session hijacking or further internal attacks.