coturn CVE-2026-53450

Exploitation requires an authenticated TURN client (valid coturn credentials, matching CVSS PR:L) that can send a TURN allocation/relay request with a crafted XOR-PEER-ADDRESS of the IPv4-mapped IPv6 form ::ffff:127.0.0.1. The bypass works even in the default posture where allow-loopback-peers is disabled, so no special non-default configuration is needed to trigger it. The meaningful limiting factors are: the attacker must possess valid TURN credentials, and the payoff depends entirely on there being a useful service bound to the coturn host's localhost - a host with nothing sensitive listening on loopback yields little, and deployments that already blackhole loopback/internal ranges via denied-peer-ip are protected. Affected only on coturn versions prior to 4.13.0.

The signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, base 7.4) reflects a network-reachable, low-complexity attack that nonetheless requires valid TURN credentials (PR:L) and yields only low-magnitude confidentiality, integrity, and availability impact, with the scope change (S:C) capturing that the relay is abused to reach services outside the TURN authorization boundary. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV/POC means this is a real-but-not-emergency priority. The key caveat is that real impact is entirely contingent on what services listen on the coturn host's localhost - an internal admin API, metrics endpoint, database, or cloud metadata proxy behind localhost would raise the effective impact well above the CVSS 'Low' ratings, while a hardened host with nothing sensitive on loopback limits it. Because credentials are required, risk concentrates in shared or multi-tenant TURN deployments where relay accounts are broadly issued.

An attacker who holds valid TURN credentials (for example, a legitimate user of a shared WebRTC/TURN service) creates a TURN allocation and issues a relay request with XOR-PEER-ADDRESS set to ::ffff:127.0.0.1 plus the target port, causing coturn to forward the attacker's traffic to a service listening only on the host's loopback interface. This lets the attacker reach otherwise-unreachable localhost services - such as an internal admin panel, metrics/debug endpoint, or metadata proxy - for information disclosure or limited manipulation. No public exploit code has been identified, and the low attack complexity means a working request is trivial to craft once credentials are obtained.