CVE-2026-55663: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55663 is an SCTP state cookie forgery vulnerability in mediasoup, a WebRTC video conferencing system, caused by the absence of cryptographic authentication on SCTP state cookies in violation of RFC 9260 Section 5.1.3. Affected versions are npm package mediasoup >= 3.20.0 and <= 3.20.5, and Rust crate mediasoup >= 0.22.0 and <= 0.22.4. The vulnerability was originally published on June 15, 2026, and added to the GitHub Advisory Database on August 25, 2026. It carries a CVSS v3.1 base score of 5.6 (Medium) (Github Advisory, Versatica Advisory).

The root cause is CWE-345 (Insufficient Verification of Data Authenticity): mediasoup's SCTP stack validates state cookies using only two hardcoded magic values — "msworker" (8 bytes at offset 0) and 0xAD81 (2 bytes at offset 38) — with no per-instance secret, HMAC, or nonce, directly violating RFC 9260 Section 5.1.3. The 44-byte cookie structure in worker/include/RTC/SCTP/association/StateCookie.hpp places all security-relevant fields (localVerificationTag, remoteVerificationTag, TSN, tieTag) under full attacker control. The sole authentication check in Association::HandleReceivedCookieEchoChunk() compares the SCTP packet's verification tag against the localVerificationTag field inside the cookie — both of which the attacker controls — making the check trivially bypassable. Additionally, Association::ValidateReceivedPacket() explicitly skips verification-tag validation for COOKIE-ECHO packets, and the CRC32c checksum is never verified on the receive path, so any forged packet is accepted. A public PoC Python script is included in the security advisory (Versatica Advisory, Github Advisory).

A successful exploit allows an on-path attacker to skip the standard SCTP 4-way handshake entirely, establish an unauthorized SCTP association, and inject arbitrary DataChannel messages as a trusted peer. This results in low confidentiality impact (intercepted DataChannel content), low integrity impact (injected messages), and low availability impact (denial of service by preempting the legitimate peer's association). Deployments using PlainTransport or PipeTransport with SCTP enabled and no SRTP are at risk, including server-to-server SFU interconnects; WebRtcTransport is not affected because its SCTP runs inside a DTLS session (Versatica Advisory).

A proof-of-concept Python script is publicly available in the official security advisory, demonstrating full cookie forgery using only Python's standard library. The NVD SSVC assessment classifies exploitation as "poc" and not automatable, reflecting the requirement for an on-path network position. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. No threat actor attribution or in-the-wild exploitation has been reported (Github Advisory, Versatica Advisory).

1. Reconnaissance: Identify a mediasoup server running PlainTransport or PipeTransport with SCTP enabled and no SRTP (srtpCryptoSuite not configured). Confirm the server's UDP IP:port is reachable from a network position where the attacker can send spoofed or on-path UDP packets.
2. Craft the forged state cookie: Build a 44-byte cookie buffer with b'msworker' at offset 0, an attacker-chosen LOCAL_VT (e.g., 0xDEADBEEF) at offset 8 as localVerificationTag, arbitrary values for remaining fields, and 0xAD81 at offset 38 as Magic2. This passes StateCookie::IsMediasoupStateCookie() validation.
3. Construct the SCTP COOKIE-ECHO packet: Wrap the 44-byte cookie in a COOKIE-ECHO chunk (type 0x0A), set the SCTP common header's Verification Tag to LOCAL_VT (matching the cookie's localVerificationTag), and compute any CRC32c value (or leave it arbitrary, as it is never verified on receive).
4. Send the forged packet: Transmit the UDP packet to the mediasoup server from the permitted source address (or any source if comedia=true is enabled). The server's HandleReceivedCookieEchoChunk() accepts the packet because packet.VerificationTag == cookie.localVerificationTag.
5. Establish unauthorized association and inject messages: With the SCTP association now established, send DATA chunks to inject arbitrary DataChannel messages as a trusted peer, enabling data integrity violations or denial of service against the legitimate peer (Versatica Advisory, Github Advisory).

• Network: Unexpected SCTP COOKIE-ECHO UDP packets arriving at a PlainTransport or PipeTransport port from an IP address that is not the configured peer (especially if comedia=false); SCTP associations established without a preceding INIT/INIT-ACK exchange observable in network captures; UDP packets with SCTP chunk type 0x0A (COOKIE-ECHO) containing the hex prefix 6d73776f726b6572 (msworker) in the payload.
• Logs: Unexpected new SCTP association events in mediasoup worker logs without a corresponding legitimate client connection; DataChannel messages received from an association that was not initiated by the expected peer.
• Process/Behavior: Sudden appearance of a second SCTP association on a transport that should have only one peer; legitimate peer reporting loss of its SCTP association (preempted by the forged one) (Versatica Advisory).

Upgrade to npm package mediasoup version 3.20.6 or Rust crate mediasoup version 0.22.5, which introduce per-association random secret keys and HMAC-SHA1 authentication (with creation timestamp and staleness checks) for state cookies on PlainTransport and PipeTransport, as required by RFC 9260 Section 5.1.3. If immediate upgrade is not possible, mitigate by enabling SRTP (srtpCryptoSuite parameter) on all PlainTransport instances using SCTP, or by restricting network access to mediasoup UDP ports to trusted peers only via firewall rules. Avoid enabling comedia mode unless strictly necessary, as it allows packets from any source IP (Versatica Advisory, mediasoup Release).