EUVD-2026-42971Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Network-reachable relay abuse with low complexity but requiring valid TURN credentials (PR:L); scope changes as traffic reaches services beyond the TURN authorization boundary, with low impact bounded by what localhost exposes.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.
AnalysisAI
Server-side request forgery in coturn TURN/STUN server before 4.13.0 lets an authenticated TURN client bypass the default loopback-peer guard by supplying the IPv4-mapped IPv6 address ::ffff:127.0.0.1 in the XOR-PEER-ADDRESS attribute, relaying traffic to services bound only to the coturn host's localhost. The loopback check evaluates the literal IPv6 loopback shape before IPv4-mapped IPv6 normalization, so good_peer_addr never applies the rejection even when allow-loopback-peers is disabled. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is confirmed in version 4.13.0.
Technical ContextAI
coturn is the de-facto open-source implementation of the TURN (Traversal Using Relays around NAT, RFC 5766/8656) and STUN protocols, used to relay media for WebRTC and VoIP when peers cannot connect directly. TURN clients specify relay peers via the XOR-PEER-ADDRESS attribute, and coturn is supposed to refuse loopback peers unless the operator explicitly sets allow-loopback-peers. The root cause is CWE-918 (SSRF): the ioa_addr_is_loopback function tests for the canonical IPv6 loopback form (::1) before the code path that normalizes IPv4-mapped IPv6 addresses, so ::ffff:127.0.0.1 slips past the check and good_peer_addr treats it as a permitted external peer. The affected component per CPE is cpe:2.3:a:coturn:coturn (all versions prior to 4.13.0).
RemediationAI
Vendor-released patch: upgrade coturn to version 4.13.0 or later, which corrects the ordering so ioa_addr_is_loopback normalizes IPv4-mapped IPv6 addresses before the loopback test; see GHSA-w4hf-cr3w-6h79 and commit b057acbebe721c8f2f202ddad5e16289e295c754. Where immediate upgrade is not possible, apply the denied-peer-ip configuration to explicitly blackhole loopback and internal ranges - for example denied-peer-ip=127.0.0.0/8, denied-peer-ip=::1 and, critically, denied-peer-ip ranges covering IPv4-mapped IPv6 loopback (::ffff:127.0.0.0/104) plus RFC1918/internal networks you do not want relayed; the trade-off is that overly broad deny rules can break legitimate relay use if peers ever reside in those ranges. Additionally, avoid binding sensitive administrative or backend services to the same host's localhost, tighten TURN credential issuance so only trusted clients hold accounts, and enforce a strict allowed-peer allowlist where the deployment permits it. Do not rely on leaving allow-loopback-peers disabled, since that guard is precisely what this issue bypasses.
An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. R
An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. Rated h
Coturn TURN/STUN server contains an access control bypass that allows remote attackers to reach blocked internal address
Stack buffer overflow in Coturn's OAuth token decoder (decode_oauth_token_gcm()) lets remote unauthenticated attackers c
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a s
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. Rated
SQL injection in the Coturn TURN/STUN server's HTTPS admin panel (versions prior to 4.12.0) allows an authenticated admi
Format string injection in Coturn prior to 4.13.0 lets an authenticated TURN user crash the relay server or leak stack m
Memory exhaustion in Coturn 4.15.0 allows an authenticated TURN user to crash or degrade server availability by abusing
Arbitrary file overwrite in Coturn prior to 4.13.0 is possible through the CLI management interface's `psd` (print sessi
Stored XSS in Coturn's web-admin HTTPS interface (all versions prior to 4.11.0) allows a TURN-level attacker to inject p
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote cli
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today