Wormhole App vulnerabilities
Published CVEs affecting Wormhole App products: 1 record(s), with severity, exploitation and fixes.
CVE-2026-100251
Medium · 6.5
CWE-918 Oct 1, 2026
Wormhole.app SSRF
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.