DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55663: CVE-2026-55663: unauthenticated state cookie forgery in mediasoup SCTP stack

#security #cve #cybersecurity

CVE-2026-55663: unauthenticated state cookie forgery in mediasoup SCTP stack

Vulnerability ID: CVE-2026-55663
CVSS Score: 5.6
Published: 2026-08-25

A cryptographic validation flaw (CWE-345) exists in the built-in SCTP implementation of mediasoup (NPM package < 3.20.6, Rust crate < 0.22.5). Due to missing cryptographic signature verification of State Cookies, an on-path attacker targeting PlainTransport or PipeTransport without DTLS can forge state cookies containing static magic bytes. This allows the attacker to establish arbitrary SCTP associations and inject malicious DataChannel messages.

TL;DR

Unauthenticated state cookie forgery in mediasoup allows on-path attackers targeting unencrypted PlainTransport/PipeTransport to establish fake SCTP connections and inject unauthorized DataChannel messages.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-345
  • Attack Vector: Network
  • CVSS v3.1 Score: 5.6
  • Impact: Data Injection and Session Hijacking
  • Exploit Status: Proof of Concept
  • CISA KEV Listed: No

Affected Systems

  • mediasoup (npm package)
  • mediasoup (Rust crate)
  • mediasoup (npm package): >= 3.20.0, < 3.20.6 (Fixed in: 3.20.6)
  • mediasoup (Rust crate): >= 0.22.0, < 0.22.5 (Fixed in: 0.22.5)

Code Analysis

Commit: 9c1a90a

Implement cryptographically authenticated state cookies with HMAC-SHA1 to prevent forgery and state injection in SCTP associations.

worker/src/RTC/SCTP/association/StateCookie.cpp
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade to NPM version 3.20.6 or Rust crate 0.22.5
  • Enable DTLS encryption on PlainTransport and PipeTransport
  • Implement network-level access control to restrict UDP ports to trusted IPs
  • Use IPSec or secure VPN tunnels for cross-network media traffic

Remediation Steps:

  1. Review your mediasoup deployment configuration for instances of PlainTransport and PipeTransport.
  2. Check if SCTP is enabled without DTLS encapsulation on these transports.
  3. Update your package.json dependency to 'mediasoup': '^3.20.6' or Cargo.toml dependency to 'mediasoup = "0.22.5"'.
  4. Deploy network firewalls to restrict the UDP media ports of PlainTransport to known trusted IP addresses only.

References

Read the full report for CVE-2026-55663 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)