Executive brief
Coturn is an open-source server used to facilitate web-based communication (VoIP and video) by helping data bypass firewalls. A security flaw allows authorized users to bypass protections that normally prevent them from accessing the server's own internal network. This could allow an attacker to interact with sensitive services running on the server itself that were intended to be private, potentially leading to data exposure or further internal network attacks.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Coturn due to an incorrect logic sequence in the `ioa_addr_is_loopback` function. The function checks for the literal IPv6 loopback address (::1) by inspecting the final byte of the address before handling IPv4-mapped IPv6 addresses. Because the IPv4-mapped address for localhost (::ffff:127.0.0.1) also ends in a 1, the function incorrectly identifies it as a non-loopback address and returns false. An authenticated TURN client can exploit this by using the `XOR-PEER-ADDRESS` attribute to request permissions or channel bindings for the host's loopback interface. This bypasses the default `allow-loopback-peers=false` configuration, though it does not affect systems with explicit denied-peer ranges. The issue is resolved in version 4.13.0.
Affected products
- coturn coturn < 4.13.0
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date