Executive brief
Coturn is a TURN/STUN relay server used to facilitate real-time communication through firewalls. An authenticated attacker can bypass the server's denied-peer-ip access control list by re-encoding target IPv4 addresses in alternative IPv6 formats (IPv4-compatible, 6to4, or NAT64), potentially enabling relay to otherwise-blocked destinations. This affects RFC 6062 TCP CONNECT clients on systems with matching translation routes.
Technical details
The vulnerability is an access control bypass in the good_peer_addr() function, which validates relay destinations against configured denied-peer-ip ranges. The function calls ioa_addr_in_range() without first canonicalizing IPv4-in-IPv6 address encodings (IPv4-compatible ::a.b.c.d, 6to4 2002::/16, and NAT64 well-known prefix 64:ff9b::/96). Because the comparison operates on the full 16-byte IPv6 form, alternative encodings of the same IPv4 address are not recognized as matching IPv4 deny rules. An authenticated RFC 6062 TCP CONNECT relay client can exploit this by sending connection requests using alternative address encodings to reach denied peers. The vulnerability requires the Coturn host to have a useful translation route for the target encoding. Version 4.13.1 fixes this by introducing ioa_addr_get_embedded_ipv4() to extract and canonicalize embedded IPv4 addresses before range checking.
Affected products
- Coturn Coturn prior to 4.13.1
Timeline
- 2026-08-11: disclosed
- 2026-06-14: patched: Fix committed to repository; version 4.13.1 released
- 2026-08-11: advisory: CVE-2026-73212 published