https://vulnerability.circl.lu/sightings/feed 2026-08-30T16:49:59.360093+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/4642ab2a-c0e0-49bc-a88b-80cbc890ccb2/export 2026-08-30T16:49:59.389417+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4642ab2a-c0e0-49bc-a88b-80cbc890ccb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55663", "type": "seen", "source": "https://gist.github.com/alon710/61d0254c7e615b862b27242bae8aadcf", "content": "# CVE-2026-55663: CVE-2026-55663: unauthenticated state cookie forgery in mediasoup SCTP stack\n\n> **CVSS Score:** 5.6\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55663\n\n## Summary\nA cryptographic validation flaw (CWE-345) exists in the built-in SCTP implementation of mediasoup (NPM package < 3.20.6, Rust crate < 0.22.5). Due to missing cryptographic signature verification of State Cookies, an on-path attacker targeting PlainTransport or PipeTransport without DTLS can forge state cookies containing static magic bytes. This allows the attacker to establish arbitrary SCTP associations and inject malicious DataChannel messages.\n\n## TL;DR\nUnauthenticated state cookie forgery in mediasoup allows on-path attackers targeting unencrypted PlainTransport/PipeTransport to establish fake SCTP connections and inject unauthorized DataChannel messages.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.6\n- **Impact**: Data Injection and Session Hijacking\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Listed**: No\n\n## Affected Systems\n\n- mediasoup (npm package)\n- mediasoup (Rust crate)\n- **mediasoup (npm package)**: >= 3.20.0, < 3.20.6 (Fixed in: `3.20.6`)\n- **mediasoup (Rust crate)**: >= 0.22.0, < 0.22.5 (Fixed in: `0.22.5`)\n\n## Mitigation\n\n- Upgrade to NPM version 3.20.6 or Rust crate 0.22.5\n- Enable DTLS encryption on PlainTransport and PipeTransport\n- Implement network-level access control to restrict UDP ports to trusted IPs\n- Use IPSec or secure VPN tunnels for cross-network media traffic\n\n**Remediation Steps:**\n1. Review your mediasoup deployment configuration for instances of PlainTransport and PipeTransport.\n2. Check if SCTP is enabled without DTLS encapsulation on these transports.\n3. Update your package.json dependency to 'mediasoup': '^3.20.6' or Cargo.toml dependency to 'mediasoup = \"0.22.5\"'.\n4. Deploy network firewalls to restrict the UDP media ports of PlainTransport to known trusted IP addresses only.\n\n## References\n\n- [GHSA-p7x2-g5cq-fhmq: mediasoup SCTP State Cookie Forgery](https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq)\n- [SCTP Cookie Cryptographic Verification Commit](https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7)\n- [Pull Request #1829: Secure State Cookie Implementation](https://github.com/versatica/mediasoup/pull/1829)\n- [mediasoup v3.20.6 Release Notes](https://github.com/versatica/mediasoup/releases/tag/3.20.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55663) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T08:09:19.895486Z"} 2026-08-26T08:09:19.895486+00:00 https://vulnerability.circl.lu/sighting/930ca09a-aa95-47ca-9f89-ab0c17eb6768/export 2026-08-30T16:49:59.393952+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "930ca09a-aa95-47ca-9f89-ab0c17eb6768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55663", "type": "published-proof-of-concept", "source": "https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq", "content": "", "creation_timestamp": "2026-08-25T20:35:20.301736Z"} 2026-08-25T20:35:20.301736+00:00