# CVE-2026-73213: Coturn IPv6 range check bypass in TURN relay

Source: https://junglewise.ai/threats/cve-2026-73213-coturn-ipv6-range-check-bypass-in-turn-relay  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73213 · Severity: info · Published 2026-08-11

Coturn is an open-source TURN/STUN server used to relay media traffic between peers in communications applications. A flaw in IPv6 address range validation allows an authenticated attacker to bypass configured peer IP restrictions and relay traffic to denied IPv6 addresses that fall within non-prefix-aligned ranges. This could enable unauthorized media relay to restricted destinations.

Technologies: [Coturn](https://junglewise.ai/threats/technologies/coturn). Vendors: [Coturn](https://junglewise.ai/threats/vendors/coturn).

## Quick answers

**Is CVE-2026-73213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73213 being exploited in the wild.

**How severe is CVE-2026-73213?** Informational severity, published 11 August 2026.

**Which products and versions are affected?** Coturn before 4.16.0.

**Is there a fix for CVE-2026-73213?** A patch was published on 2026-07-31: Fixed in version 4.16.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73213 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73213?** Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the addr_less_eq() function in src/client/ns_turn_ioaddr.c, which performs component-wise comparison for IPv6 min-max intervals within the ioa_addr_in_range() check. This comparison logic fails to correctly identify IPv6 addresses that are numerically within a configured denied-peer-ip range but are incorrectly classified as outside it, particularly when the range is not prefix-aligned. An authenticated TURN client can exploit this to relay traffic to IPv6 peers that should have been blocked. The issue is fixed in version 4.16.0.

## Affected products

- Coturn Coturn before 4.16.0

## Timeline

- 2026-08-11: disclosed
- 2026-07-31: patched: Fixed in version 4.16.0

## References

- [https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28](https://github.com/coturn/coturn/commit/6c13608c28a04af5d63abddd7565a0dcc4771c28)
- [https://github.com/coturn/coturn/releases/tag/4.16.0](https://github.com/coturn/coturn/releases/tag/4.16.0)

## Related threats

- [Coturn quota bypass in mobility-enabled allocations](https://junglewise.ai/threats/cve-2026-73216-coturn-quota-bypass-in-mobility-enabled-allocations)
- [Coturn EVEN-PORT relay port exhaustion](https://junglewise.ai/threats/cve-2026-73215-coturn-even-port-relay-port-exhaustion)
- [Coturn DTLS memory exhaustion via fragmented ClientHello](https://junglewise.ai/threats/cve-2026-73214-coturn-dtls-memory-exhaustion-via-fragmented-clienthello)
- [Coturn TURN/STUN relay ACL bypass via IPv6 address encoding](https://junglewise.ai/threats/cve-2026-73212-coturn-turn-stun-relay-acl-bypass-via-ipv6-address-encoding)
- [Coturn authorization bypass in MICE mobility session resumption](https://junglewise.ai/threats/cve-2026-65981-coturn-authorization-bypass-in-mice-mobility-session-resumption)