Technical impact
coturn, a TURN/STUN server, allows attackers to circumvent configured IP blocks by using IPv4‑mapped IPv6 addresses in CreatePermission or ChannelBind requests. A request with XOR‑PEER‑ADDRESS set to "::ffff:127.0.0.1" receives a successful response even though 127.0.0.0/8 is listed in denied‑peer‑ip. The flaw stems from missing IPv4‑mapped checks in address‑validation functions, enabling unauthorized peer connections.
Affected Systems
coturn installed from the coturn project, versions prior to 4.9.0 are affected. The issue applies to all builds that rely on the ns_turn_ioaddr.c address handling, regardless of operating system or deployment model. Administrators must verify whether they are using a version earlier than 4.9.0 and whether denied‑peer‑ip ACLs are configured.
Risk and Exploitability
With a CVSS score of 7.2, the vulnerability poses a significant authorization breach risk; however, the EPSS score of less than 1% suggests that exploits are currently scarce. Because the flaw is triggered by a network‑based TURN request, attackers must be able to reach the server, making it exploitable over public or internal networks. The absence of a KEV listing indicates no widespread active exploitation yet, but the control bypass remains critical for environments that rely on denied‑peer‑ip to restrict local or private traffic.
