Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55663— mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Quick assessment

Affected
versatica mediasoup
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mediasoup 是一个 WebRTC 视频会议系统。在 npm 包的 3.20.0 至 3.20.6 版本，以及 Rust 库的 0.22.0 至 0.22.5 版本中，mediasoup 内置的 SCTP 协议栈仅使用硬编码的 和 魔法值对状态 Cookie 进行身份验证，而非采用每个实例独立的密钥与 HMAC 机制。这种做法不符合 RFC 9260 第 5.1.3 节的要求。 具体而言，在文件 和 中实现的 Cookie 结构与验证逻辑存在缺陷。针对启用 SCTP 但未提供 DTLS 保护的 PlainTr

CVSS 5.6 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
versatica mediasoup >= 3.20.0, < 3.20.6 affected
>= 0.22.0, < 0.22.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55663

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
Source: CVE Program / CVE List V5
Vulnerability Description
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance secret and HMAC, contrary to RFC 9260 Section 5.1.3. The cookie structure and validation in worker/include/RTC/SCTP/association/StateCookie.hpp and worker/src/RTC/SCTP/association/StateCookie.cpp allow an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO whose packet verification tag matches the attacker-controlled localVerificationTag. The forged cookie passes StateCookie::IsMediasoupStateCookie() and Association::HandleReceivedCookieEchoChunk(), establishes an unauthorized SCTP association, and permits DataChannel message injection as a trusted peer. WebRtcTransport is not affected because its SCTP runs inside DTLS. This issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
versatica mediasoup >= 3.20.0, < 3.20.6 -

II. Public POCs for CVE-2026-55663

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55663

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55663 (1)

Vendor Pages for CVE-2026-55663 (1)

IV. Related Vulnerabilities

Same weakness: CWE-345

V. Comments for CVE-2026-55663

No comments yet

Leave a comment