CVE-2026-55663

creationtimestamp| type| source ---|---|--- 2026-08-25 20:35:20+00:00| published-proof-of-concept| https://github.com/versatica/mediasoup/security/advisories/GHSA-p7x2-g5cq-fhmq 2026-08-26 08:09:19+00:00| seen| https://gist.github.com/alon710/61d0254c7e615b862b27242bae8aadcf...

CVE-2026-55663

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

GHSA-P7X2-G5CQ-FHMQ mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Summary mediasoup's built-in SCTP stack introduced in v3.20.0 authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled and no...

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Summary mediasoup's built-in SCTP stack introduced in v3.20.0 authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled and no...

NPM: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

NPM: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment RFC 9260 violation vulnerability discovered by ? in WordPress Npm mediasoup versions = 3.20.0, = 3.20.5...

CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

EUVD-2026-65694

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663

mediasoup , a WebRTC video conferencing system, contains a flaw in its built-in SCTP stack where state cookies are authenticated using only hardcoded magic values (msworker and 0xAD81) instead of a per-instance secret with HMAC, violating RFC 9260 §5.1.3. An on-path attacker targeting PlainTransp...

CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

PT-2026-81477

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

CVE-2026-55663: Insufficient Verification of Data Authenticity

mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP stack authenticates state cookies using only the hardcoded msworker and 0xAD81 magic values instead of a per-instance...

Malicious code in mediasoup-sdp-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 787d5f3827745d92a595564c8d8a741f0dcc157284679e84ddab6012eedc8bed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4538 Malicious code in mediasoup-sdp-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 787d5f3827745d92a595564c8d8a741f0dcc157284679e84ddab6012eedc8bed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview mediasoup-sdp-bridge is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...