What is GHSA-7r4f-37cf-v9wq?

GHSA-7r4f-37cf-v9wq is a security advisory published by GitHub Security Advisories with Medium severity. Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not...

Which CVE IDs does GHSA-7r4f-37cf-v9wq cover?

GHSA-7r4f-37cf-v9wq covers the following CVE IDs: CVE-2026-100251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7r4f-37cf-v9wq?

GHSA-7r4f-37cf-v9wq has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-7r4f-37cf-v9wqMediumCVSS 6.5

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not...

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-100251 →

📋 Description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-100251
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json
https://wormhole.app
https://www.cve.org/CVERecord?id=CVE-2026-100251
https://github.com/advisories/GHSA-7r4f-37cf-v9wq