CVE-2026-55663

{"id": "CVE-2026-55663", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55663", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T18:55:43.763697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "versatica", "product": "mediasoup", "versions": [{"status": "affected", "version": ">= 3.20.0, < 3.20.6"}, {"status": "affected", "version": ">= 0.22.0, < 0.22.5"}]}]}], "published": "2026-08-25T19:16:51.060", "references": [{"url": "https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7", "source": "security-advisories@github.com"}, {"url": "https://github.com/versatica/mediasoup/pull/1829", "source": "security-advisories@github.com"}, {"url": "https://github.com/versatica/mediasoup/releases/tag/3.20.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq", "source": "security-advisories@github.com"}, {"url": "https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5."}], "lastModified": "2026-09-09T21:07:31.353", "sourceIdentifier": "security-advisories@github.com"}