The vulnerability arises from the bad_peer_addr() routine not canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass a denied‑peer‑ip range set on the TURN server. The flaw is effectively a server‑side request‑forgery (CWE‑918) combined with an authorization bypass (CWE‑284). An attacker who can authenticate to the TURN service can issue a CONNECT request to any address that the server can reach, giving them internal‑network SSRF and, in the documented proof‑of‑concept, internal‑root remote code execution.

The problem affects every installation of coturn running a version older than 4.13.1. The bug was fixed in the 4.13.1 release, so only those running 4.13.0 or earlier are vulnerable.

The CVSS score is 5.8, indicating moderate severity, and the EPSS score is less than 1 %, implying a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated client capable of using the RFC 6062 TCP CONNECT relay and a translation route on the host that can resolve the malicious target address. Once bypassed, the attacker can reach internal hosts that were supposed to be blocked, and the documented proof shows that this can elevate to root on the TURN server.