Skip to main content

Coturn CVE-2026-73212

| EUVDEUVD-2026-56789 MEDIUM
Improper Access Control (CWE-284)
2026-08-11 security-advisories@github.com
Authentication Bypass Suse Red Hat
5.8
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
5.8 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Requires authenticated relay access (PR:L) and a live IPv4 translation route on the host (AC:H); scope changes as high confidentiality and integrity impact falls on subsequently reachable internal systems, with no direct availability impact on Coturn itself.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
SUSE
MEDIUM
qualitative
Red Hat
7.7 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 11, 2026 - 22:48 vuln.today
Analysis Generated
Aug 11, 2026 - 22:48 vuln.today
Patch available
Aug 11, 2026 - 18:49 EUVD

DescriptionCVE.org

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.

AnalysisAI

Coturn TURN/STUN server prior to version 4.13.1 exposes an IPv4 access control bypass through incomplete IPv6 address canonicalization, allowing authenticated RFC 6062 TCP CONNECT relay clients to reach peer addresses that administrators intended to block via denied-peer-ip rules. The bypass exploits three IPv4-in-IPv6 encoding formats - IPv4-compatible (::/96), 6to4 (2002::/16), and NAT64 (64:ff9b::/96) - that the peer address validation function failed to normalize before comparing against configured ACL ranges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid TURN credentials
Delivery
Identify IPv4 target blocked by denied-peer-ip ACL
Exploit
Re-encode target as NAT64 or 6to4 IPv6 address
Execution
Send RFC 6062 TCP CONNECT relay request to Coturn
Persist
good_peer_addr() skips blocked range during ACL check
Impact
Relay TCP session established to restricted internal host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all three of the following to be simultaneously true: (1) the attacker holds valid TURN credentials and operates as an authenticated RFC 6062 TCP CONNECT relay client - unauthenticated clients cannot trigger this path; (2) the Coturn deployment has at least one denied-peer-ip IPv4 range configured - if no ACL is set there is nothing to bypass; and (3) the Coturn host must possess a functional IPv4 translation route for at least one of the three affected encoding families (NAT64 via 64:ff9b::/96, 6to4 via 2002::/16, or IPv4-compatible via ::/96) so that the re-encoded peer address is actually routable from the server to the target. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.8 reflects a network-reachable, authenticated bypass with high impact on subsequent systems (SC:H/SI:H/SA:H) but requires a specific precondition - the Coturn host must have a live IPv4 translation route for NAT64, 6to4, or IPv4-compatible forwarding (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated TURN client with RFC 6062 TCP CONNECT capability identifies an internal host whose IPv4 address (e.g., 10.0.0.1) is covered by Coturn's denied-peer-ip blocklist, then re-encodes that address as its NAT64 equivalent (64:ff9b::0a00:0001) and issues a TCP CONNECT relay request to the server. Because Coturn's pre-4.13.1 peer address validation does not canonicalize the NAT64 encoding, the denied-peer-ip ACL check passes without matching, and the server establishes a TCP relay session to the otherwise-blocked internal host. …
Remediation Upgrade to Coturn 4.13.1, the vendor-released patch available at https://github.com/coturn/coturn/releases/tag/4.13.1, which resolves the canonicalization gap by introducing ioa_addr_get_embedded_ipv4() applied consistently across all address-comparison code paths. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-73212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy