CVE-2026-53450

Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection

Published Jul 10, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

Analysis

Technical impact

Coturn implements TURN/STUN services and by default rejects loopback peers. Prior to version 4.13.0, an authenticated client can send a TURN packet that contains the IPv4‑mapped IPv6 address ::ffff:127.0.0.1 in the XOR-PEER-ADDRESS attribute. This causes the server to treat the loopback address as an external peer, bypassing the default protection and allowing traffic to be relayed to processes bound only to 127.0.0.1. The flaw is an access‑control failure (CWE‑289) and a failure to handle IPv4‑mapped addresses correctly (CWE‑918).

Affected Systems

coturn:coturn versions earlier than 4.13.0 are vulnerable. The default configuration disables allow-loopback-peers, so any installation that has not been updated to 4.13.0 or newer is at risk.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity, while the EPSS of <1% suggests a low to moderate exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the TURN server; once authenticated, they can craft packets to relay traffic to the localhost. No additional local privileges on the coturn host are required, and the attack classifies as a remote network exploit via the TURN protocol.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

coturn

affected

Version	Status	Constraints
`< 4.13.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Coturn

Version	Status	Scheme	Platform
`[0,4.13.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade coturn to version 4.13.0 or later to apply the fix that restores loopback peer rejection.
If an upgrade is not immediately feasible, restrict TURN client authentication to trusted networks and enforce strict ACLs so that only authorized peers can connect.
Lock down any services bound to 127.0.0.1 by configuring them to listen only on the loopback interface and, if possible, block TURN‑relay traffic to loopback addresses with firewall rules.

Generated by OpenCVE AI on August 1, 2026 at 12:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.290% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754
https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79
https://nvd.nist.gov/vuln/detail/CVE-2026-53450
https://www.cve.org/CVERecord?id=CVE-2026-53450

History

Jul 11, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-289
References		https://nvd.nist.gov/vuln/detail/CVE-2026-53450 https://www.cve.org/CVERecord?id=CVE-2026-53450
Metrics	threat_severity `None`	threat_severity `Important`

Jul 10, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Coturn Coturn coturn
Vendors & Products		Coturn Coturn coturn

Jul 10, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 10, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.
Title		Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
Weaknesses		CWE-918
References		https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754 https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L'}`