The vulnerability arises because Coturn processes STUN attributes following the MESSAGE-INTEGRITY field before verifying that the HMAC covers the entire message. In versions prior to 4.15.0, an attacker who can intercept the traffic may append or alter attributes such as LIFETIME, XOR-PEER-ADDRESS, or ORIGIN. The HMAC remains valid because it covers only a message prefix, and the server recomputes the unkeyed FINGERPRINT after the change. This represents a weakness in cryptographic verification (CWE-345) and a failure to enforce origin checks (CWE-924). Additionally, the manipulation can be considered a misuse of parameter injection (CWE-354). Consequently, modified attributes can extend allocation lifetimes, inject new permissions, or bypass origin restrictions while the request appears authenticated.

Any deployment of the open-source coturn server running a version before 4.15.0 is affected. The issue applies to plain UDP or TCP TURN/STUN traffic; TLS and DTLS endpoints are not vulnerable because they prevent the in‑transit modification. The affected product is coturn, and all releases prior to 4.15.0 contain the flaw.

The CVSS score of 2.3 indicates low severity, and the EPSS score of 0.00131 (i.e., <1%) suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An on-path network adversary would need the ability to intercept and alter TURN packets, which is common in compromised or untrusted networks, but the lack of a TLS/DTLS mitigates the risk in secured deployments. Updating to 4.15.0 eliminates the issue, while TLS/DTLS provides an additional defensive layer.