# CVE-2026-53450: Coturn loopback protection bypass via IPv4-mapped IPv6 addresses

Source: https://junglewise.ai/threats/cve-2026-53450-coturn-loopback-protection-bypass-via-ipv4-mapped-ipv6-addresses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-53450 · Severity: high · CVSS 7.4 · Published 2026-07-10

Coturn is an open-source server used to facilitate web-based communication (VoIP and video) by helping data bypass firewalls. A security flaw allows authorized users to bypass protections that normally prevent them from accessing the server's own internal network. This could allow an attacker to interact with sensitive services running on the server itself that were intended to be private, potentially leading to data exposure or further internal network attacks.

Technologies: [Coturn](https://junglewise.ai/threats/technologies/coturn). Vendors: [Coturn](https://junglewise.ai/threats/vendors/coturn).

## Quick answers

**Is CVE-2026-53450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53450 being exploited in the wild.

**How severe is CVE-2026-53450?** High severity, with a CVSS score of 7.4, published 10 July 2026.

**Which products and versions are affected?** Coturn < 4.13.0.

**Is there a fix for CVE-2026-53450?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53450 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-53450?** Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Coturn due to an incorrect logic sequence in the `ioa_addr_is_loopback` function. The function checks for the literal IPv6 loopback address (::1) by inspecting the final byte of the address before handling IPv4-mapped IPv6 addresses. Because the IPv4-mapped address for localhost (::ffff:127.0.0.1) also ends in a 1, the function incorrectly identifies it as a non-loopback address and returns false. An authenticated TURN client can exploit this by using the `XOR-PEER-ADDRESS` attribute to request permissions or channel bindings for the host's loopback interface. This bypasses the default `allow-loopback-peers=false` configuration, though it does not affect systems with explicit denied-peer ranges. The issue is resolved in version 4.13.0.

## Affected products

- coturn coturn < 4.13.0

## Timeline

- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date

## References

- [https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754](https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754)
- [https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79](https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79)

## Related threats

- [Coturn quota bypass in mobility-enabled allocations](https://junglewise.ai/threats/cve-2026-73216-coturn-quota-bypass-in-mobility-enabled-allocations)
- [Coturn EVEN-PORT relay port exhaustion](https://junglewise.ai/threats/cve-2026-73215-coturn-even-port-relay-port-exhaustion)
- [Coturn DTLS memory exhaustion via fragmented ClientHello](https://junglewise.ai/threats/cve-2026-73214-coturn-dtls-memory-exhaustion-via-fragmented-clienthello)
- [Coturn IPv6 range check bypass in TURN relay](https://junglewise.ai/threats/cve-2026-73213-coturn-ipv6-range-check-bypass-in-turn-relay)
- [Coturn TURN/STUN relay ACL bypass via IPv6 address encoding](https://junglewise.ai/threats/cve-2026-73212-coturn-turn-stun-relay-acl-bypass-via-ipv6-address-encoding)