# CVE-2026-73216: Coturn quota bypass in mobility-enabled allocations

Source: https://junglewise.ai/threats/cve-2026-73216-coturn-quota-bypass-in-mobility-enabled-allocations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73216 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Coturn is a free TURN/STUN server used for peer-to-peer audio and video communication. An authenticated user can exploit a flaw in the mobility feature to hold multiple relay port allocations despite per-user and system-wide quota limits, eventually exhausting the server's relay port pool and preventing legitimate connections.

Technologies: [Coturn](https://junglewise.ai/threats/technologies/coturn). Vendors: [Coturn](https://junglewise.ai/threats/vendors/coturn).

## Quick answers

**Is CVE-2026-73216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73216 being exploited in the wild.

**How severe is CVE-2026-73216?** Medium severity, with a CVSS score of 6.5, published 11 August 2026.

**Which products and versions are affected?** Coturn prior to 4.17.0.

**Is there a fix for CVE-2026-73216?** A patch was published on 2026-08-05: Fixed in version 4.17.0 released 2026-08-05 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73216 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-73216?** Check whether you run Coturn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in shutdown_client_connection() in src/server/ns_turn_server.c, where bandwidth accounting and quota are prematurely released during the first-stage close of a mobility-enabled allocation while the allocation, relay socket, session, and mobility ticket remain active and resumable. An authenticated client can repeatedly create mobility allocations over TCP, disconnect, and immediately re-allocate, bypassing --user-quota and --total-quota restrictions. The client can therefore hold many live relay allocations (up to 508 ports) across quota boundaries. The fix, released in version 4.17.0, defers quota and bandwidth release until the final second-stage teardown, ensuring the charge is held for as long as the allocation remains valid and resumable.

## Affected products

- Coturn Coturn prior to 4.17.0

## Timeline

- 2026-08-11: disclosed: CVE-2026-73216 published
- 2026-08-05: patched: Fixed in version 4.17.0 released 2026-08-05

## References

- [https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b](https://github.com/coturn/coturn/commit/3c5b2615fd405c4e7c5bf3fbeef895c94a90671b)
- [https://github.com/coturn/coturn/releases/tag/4.17.0](https://github.com/coturn/coturn/releases/tag/4.17.0)

## Related threats

- [Coturn EVEN-PORT relay port exhaustion](https://junglewise.ai/threats/cve-2026-73215-coturn-even-port-relay-port-exhaustion)
- [Coturn DTLS memory exhaustion via fragmented ClientHello](https://junglewise.ai/threats/cve-2026-73214-coturn-dtls-memory-exhaustion-via-fragmented-clienthello)
- [Coturn IPv6 range check bypass in TURN relay](https://junglewise.ai/threats/cve-2026-73213-coturn-ipv6-range-check-bypass-in-turn-relay)
- [Coturn TURN/STUN relay ACL bypass via IPv6 address encoding](https://junglewise.ai/threats/cve-2026-73212-coturn-turn-stun-relay-acl-bypass-via-ipv6-address-encoding)
- [Coturn authorization bypass in MICE mobility session resumption](https://junglewise.ai/threats/cve-2026-65981-coturn-authorization-bypass-in-mice-mobility-session-resumption)