The coturn server implementation is affected by an authorization bypass vulnerability that could allow authenticated users to exceed their intended privileges.

The software contains an authorization bypass (CWE-639) where user-controlled keys are not sufficiently validated. The vulnerability requires the attacker to have low-level authentication (PR:L) to successfully execute the bypass.

With a CVSS score of 7.1, this vulnerability presents a significant risk to the confidentiality and integrity of communication infrastructure. Unauthorized access to a TURN or STUN server can facilitate traffic interception or unauthorized relaying of data, potentially resulting in severe security breaches for services relying on these protocols.

Immediate Action: Upgrade the coturn server installation to version 4.15.0 or the latest available stable release to resolve the authorization logic flaw.

Proactive Monitoring: Monitor server logs for unauthorized attempts to access relay services or unusual authentication patterns that deviate from standard user behavior.

Compensating Controls: Utilize network-level access control lists to restrict traffic to the TURN or STUN server, ensuring that only trusted clients can interact with the service while the update is being deployed.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates a prompt upgrade to version 4.15.0. Security teams should verify their current coturn deployment versions immediately and apply the necessary patches to mitigate the risk of unauthorized access to critical communication relay infrastructure.