CVE-2026-55663: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
mediasoup’s built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled (and no SRTP/DTLS protection) can craft a forged COOKIE-ECHO chunk that passes all validation, establishing an unauthorized SCTP association and gaining the ability to inject DataChannel messages as a trusted peer.
References
- github.com/advisories/GHSA-p7x2-g5cq-fhmq
- github.com/versatica/mediasoup/commit/9c1a90a8f9206b965e727d134846fb42df4980a7
- github.com/versatica/mediasoup/pull/1829
- github.com/versatica/mediasoup/releases/tag/3.20.6
- github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq
- nvd.nist.gov/vuln/detail/CVE-2026-55663
Code Behaviors & Features
Detect and mitigate CVE-2026-55663 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →