The vulnerability resides in the TURN server implementation coturn. Before version 4.15.0, a client that had previously used the --mobility feature could resume a TURN allocation by sending a REFRESH request that contained a victim MOBILITY‑TICKET. The server authenticates the request using the resuming user's credentials but fails to verify that the credentials match the original allocation owner. As a result, an attacker who can obtain a victim’s mobility ticket can receive and inject relayed traffic meant for that victim and can exhaust the victim’s relay quota; this is a CWE‑303 and CWE‑639 flaw.

All releases of coturn up to and including 4.14.999 are vulnerable, while version 4.15.0 and later contain the fix. The affected product is the coturn TURN server.

The CVSS base score of 7.1 indicates a high‑impact vulnerability. The EPSS score of less than 1 % suggests that exploitation is unlikely in the wild at present. The attack requires the attacker to possess a valid MOBILITY‑TICKET belonging to a victim, which can be obtained through social engineering or credential compromise. The remedy is to upgrade to 4.15.0 or later, or to disable the --mobility functionality until the upgrade is performed.