shutdown_client_connection() in the TURN server prematurely releases bandwidth accounting during the first-stage close of a mobility‑enabled allocation while preserving the allocation, relay socket, session, and mobility ticket. This allows an authenticated client to bypass the --user-quota and --total-quota limits, depleting the server’s relay ports and causing service disruption. The vulnerability corresponds to CWE‑400 and CWE‑911.

All versions of the coturn TURN/STUN server published before 4.17.0 are affected. The flaw resides in src/server/ns_turn_server.c and impacts instances configured with mobility support.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the current landscape, and the flaw is not listed in CISA KEV. An attacker would need valid TURN credentials to target the service via its network port, triggering the quota‑bypass path and consuming relay sockets until the server runs out of ports. Based on the description, the vulnerability pertains only to authenticated traffic; support for unauthenticated traffic is inferred to be ineffective because the flaw requires client authentication to exploit.