Skip to content
OpenAdvisories
Medium VA-26-275-04 1 CVE

wormhole.app WebRTC TURN relay

Published Oct 1, 2026 · Updated Oct 1, 2026

Vendor: Wormhole App Product: Wormhole

Summary

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-100251

    Wormhole.app SSRF

    Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

    Wormhole App Wormhole

Revision history

  1. #1.0.0

    Initial Publication