Loopback Bypass in Coturn TURN/STUN Server

Compliance Impact

This vulnerability allows an authenticated attacker to bypass loopback peer restrictions and potentially expose services bound only to localhost on the coturn host through TURN relay traffic.

Such unauthorized exposure of internal services could lead to unauthorized access to sensitive data or systems, which may impact compliance with data protection regulations like GDPR or HIPAA that require strict access controls and protection of personal or sensitive information.

Therefore, exploitation of this vulnerability could undermine the security controls necessary to meet these regulatory requirements, increasing the risk of data breaches or unauthorized data exposure.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-53450 is a vulnerability in coturn, an open source TURN server implementation. The issue arises because coturn's function that checks for loopback addresses does not correctly identify IPv4-mapped IPv6 loopback addresses like ::ffff:127.0.0.1. While coturn normally rejects loopback peers by default, this check can be bypassed by using the IPv4-mapped IPv6 format, allowing an authenticated TURN client to bypass the default loopback rejection.

This means that services bound only to localhost on the coturn host can be exposed through TURN relay traffic, which should normally be protected. The vulnerability is fixed in coturn version 4.13.0 by reordering the address checks to properly detect IPv4-mapped IPv6 loopback addresses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to bypass coturn's default security control that rejects loopback peers. By exploiting the incorrect loopback address check, the attacker can access services that are bound only to localhost on the coturn host through TURN relay traffic.

The impact includes potential unauthorized exposure of local services, which could lead to information disclosure, integrity compromise, or availability issues on the affected host. The CVSS score of 7.4 indicates a high severity with low attack complexity and no user interaction required.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated TURN client bypassing loopback peer restrictions by using an IPv4-mapped IPv6 address (::ffff:127.0.0.1) in TURN XOR-PEER-ADDRESS attributes. Detection would involve monitoring TURN server traffic for such peer addresses that use IPv4-mapped IPv6 loopback addresses.

Commands to detect this might include inspecting TURN relay traffic or logs for peer addresses encoded as ::ffff:127.0.0.1 or similar IPv4-mapped IPv6 loopback addresses.

• Use packet capture tools like tcpdump or Wireshark to filter TURN traffic and look for XOR-PEER-ADDRESS attributes containing ::ffff:127.0.0.1.
• Example tcpdump command: tcpdump -i <interface> -nn -s0 -v udp port <coturn_port> and 'udp[<offset>:4] = 0x3a3a6666' (to filter for ::ffff prefix in TURN packets, adjusting offset as needed).
• Review coturn server logs for authenticated clients using peer addresses with IPv4-mapped IPv6 loopback addresses.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade coturn to version 4.13.0 or later, where the vulnerability is fixed by correctly handling IPv4-mapped IPv6 loopback addresses.

Until the upgrade can be applied, consider restricting authenticated TURN clients' ability to specify peer addresses or disable TURN relay functionality if not needed.

Review and tighten access controls on coturn to limit authenticated clients and monitor for suspicious peer address usage.

Useful 0 Not Useful 0