CVE-2026-53450

HIGH 7.4

Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

CWE	CWE-918
Vendor	coturn
Product	coturn
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for coturn coturn

Be the first to know when new high vulnerabilities affecting coturn coturn are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

coturn / coturn

< 4.13.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 github.com: https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754