{"vulnerability": "cve-2026-5566", "sightings": [{"uuid": "a086d014-4d72-47fa-9630-2be8030f7352", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5566", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116347447898521039", "content": "", "creation_timestamp": "2026-04-04T16:46:05.962372Z"}, {"uuid": "f3c50903-f8ec-476a-833f-43aad735fb5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5566", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miqvwfzl642m", "content": "", "creation_timestamp": "2026-04-05T14:00:25.959394Z"}, {"uuid": "722b8282-07d4-432a-86ca-53781ad31ec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5566", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mir2t6d4z22e", "content": "", "creation_timestamp": "2026-04-05T15:28:05.478334Z"}, {"uuid": "0ecd3ac1-9694-442d-82e6-934cca74a1bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5566", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mir4pcnzgv27", "content": "", "creation_timestamp": "2026-04-05T16:01:43.265420Z"}, {"uuid": "4ca70130-a32a-4f9e-ab15-31d795fcffc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5566", "type": "published-proof-of-concept", "source": "Telegram/bba5KoRxZjw4aUqHfMWZuI7ux276_2ZWKOY2q9V8MiGPKQ0", "content": "", "creation_timestamp": "2026-04-05T15:16:27.000000Z"}, {"uuid": "9cbcfa99-55bd-49f8-994b-968c754bf049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55667", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mp74aezucd2b", "content": "CVE-2026-55667 - Path Traversal in File Browser. Non-admin users with Create permission can delete arbitrary files outside scope. CVSS 8.2. Unpatched. Restrict user permissions immediately. #CVE #infosec #cybersecurity\n\nhttps://www.valtersit.com/cve/CVE-2026-55667/", "creation_timestamp": "2026-06-26T14:01:48.401917Z"}, {"uuid": "5ad94312-8de7-4314-a19c-6851220780c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55661", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpo3pvobly2u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55661 \u0432 Tina CMS: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/F40FAB53-C221-4EF4-B27A-0F8EAFC5B547", "creation_timestamp": "2026-07-02T13:02:31.998656Z"}, {"uuid": "7e449880-3144-46a6-bf2a-a57db82d7d3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55660", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpo3q2aivn2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55660 \u0432 Tina CMS: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/CF0D1F3F-E615-4B0A-A4E6-47E9B8810C2B", "creation_timestamp": "2026-07-02T13:02:36.125266Z"}, {"uuid": "edcf772b-813f-4733-a693-e635908d7c5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55669", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdatvtvhq26", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55669 \u0432 ZITADEL: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/EE9A203B-DE6F-4F58-9513-BD40694BEDEF", "creation_timestamp": "2026-07-10T23:00:08.951883Z"}, {"uuid": "930ca09a-aa95-47ca-9f89-ab0c17eb6768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55663", "type": "published-proof-of-concept", "source": "https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq", "content": "", "creation_timestamp": "2026-08-25T20:35:20.301736Z"}, {"uuid": "601c3b21-d144-498e-ba15-ac52bc39ab2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55668", "type": "published-proof-of-concept", "source": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9", "content": "", "creation_timestamp": "2026-07-20T22:37:33.297251Z"}, {"uuid": "a3b8a58e-325d-44c7-8d78-65f3c2de3edf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55667", "type": "published-proof-of-concept", "source": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr", "content": "", "creation_timestamp": "2026-07-20T22:37:35.491268Z"}, {"uuid": "4642ab2a-c0e0-49bc-a88b-80cbc890ccb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55663", "type": "seen", "source": "https://gist.github.com/alon710/61d0254c7e615b862b27242bae8aadcf", "content": "# CVE-2026-55663: CVE-2026-55663: unauthenticated state cookie forgery in mediasoup SCTP stack\n\n> **CVSS Score:** 5.6\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55663\n\n## Summary\nA cryptographic validation flaw (CWE-345) exists in the built-in SCTP implementation of mediasoup (NPM package < 3.20.6, Rust crate < 0.22.5). Due to missing cryptographic signature verification of State Cookies, an on-path attacker targeting PlainTransport or PipeTransport without DTLS can forge state cookies containing static magic bytes. This allows the attacker to establish arbitrary SCTP associations and inject malicious DataChannel messages.\n\n## TL;DR\nUnauthenticated state cookie forgery in mediasoup allows on-path attackers targeting unencrypted PlainTransport/PipeTransport to establish fake SCTP connections and inject unauthorized DataChannel messages.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.6\n- **Impact**: Data Injection and Session Hijacking\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Listed**: No\n\n## Affected Systems\n\n- mediasoup (npm package)\n- mediasoup (Rust crate)\n- **mediasoup (npm package)**: >= 3.20.0, < 3.20.6 (Fixed in: `3.20.6`)\n- **mediasoup (Rust crate)**: >= 0.22.0, < 0.22.5 (Fixed in: `0.22.5`)\n\n## Mitigation\n\n- Upgrade to NPM version 3.20.6 or Rust crate 0.22.5\n- Enable DTLS encryption on PlainTransport and PipeTransport\n- Implement network-level access control to restrict UDP ports to trusted IPs\n- Use IPSec or secure VPN tunnels for cross-network media traffic\n\n**Remediation Steps:**\n1. Review your mediasoup deployment configuration for instances of PlainTransport and PipeTransport.\n2. Check if SCTP is enabled without DTLS encapsulation on these transports.\n3. Update your package.json dependency to 'mediasoup': '^3.20.6' or Cargo.toml dependency to 'mediasoup = \"0.22.5\"'.\n4. Deploy network firewalls to restrict the UDP media ports of PlainTransport to known trusted IP addresses only.\n\n## References\n\n- [GHSA-p7x2-g5cq-fhmq: mediasoup SCTP State Cookie Forgery](https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq)\n- [SCTP Cookie Cryptographic Verification Commit](https://github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7)\n- [Pull Request #1829: Secure State Cookie Implementation](https://github.com/versatica/mediasoup/pull/1829)\n- [mediasoup v3.20.6 Release Notes](https://github.com/versatica/mediasoup/releases/tag/3.20.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55663) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T08:09:19.895486Z"}]}