Authenticated TURN clients can instruct the server to relay traffic to IPv6 peers that fall outside configured denied ranges because addr_less_eq() performs a component‑wise comparison instead of a standard lexical comparison. The vulnerability allows a time‑limited ability to connect to arbitrary IPv6 addresses, potentially exposing sensitive internal resources or exfiltrating data through the TURN relay channel. The weakness is categorized as CWE‑863 and CWE‑918, depicting an incorrect access control or filtering logic and a broken access control for authenticated users. The impact is limited to scenarios where the TURN client is authenticated and configured with IP range restrictions.

The flaw affects coturn releases earlier than version 4.16.0. Users running any coturn release before 4.16.0 are at risk, regardless of operating system. There is no known vendor emulation or alternative implementations. Version cataloging indicates that releases 4.16.0 and later contain the patch.

The vulnerability has a CVSS score of 5.8, reflecting moderate severity. EPSS indicates an exploitation probability of less than 1 %, suggesting that real‑world attacks are unlikely at present. The issue is not listed in the CISA KEV catalog. Attackers must obtain valid TURN credentials to trigger the bypass, so the risk requires an authenticated client, typically a user of the TURN service. The bug is exploitable in environments where the TURN server is exposed to untrusted clients or where internal networks are reachable from the address space of the TURN server. If exploited, an attacker could gain internal network connectivity or influence network flows through the TURN relay.