Executive brief
Coturn is an open-source TURN/STUN server used to relay media traffic between peers in communications applications. A flaw in IPv6 address range validation allows an authenticated attacker to bypass configured peer IP restrictions and relay traffic to denied IPv6 addresses that fall within non-prefix-aligned ranges. This could enable unauthorized media relay to restricted destinations.
Technical details
The vulnerability exists in the addr_less_eq() function in src/client/ns_turn_ioaddr.c, which performs component-wise comparison for IPv6 min-max intervals within the ioa_addr_in_range() check. This comparison logic fails to correctly identify IPv6 addresses that are numerically within a configured denied-peer-ip range but are incorrectly classified as outside it, particularly when the range is not prefix-aligned. An authenticated TURN client can exploit this to relay traffic to IPv6 peers that should have been blocked. The issue is fixed in version 4.16.0.
Affected products
- Coturn Coturn before 4.16.0
Timeline
- 2026-08-11: disclosed
- 2026-07-31: patched: Fixed in version 4.16.0