CVE-2026-73212

Received Received - Intake

Coturn Server IPv4 NAT64 Address Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73212

EUVD

EUVD-2026-56789

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	4.13.1
coturn	coturn	to 4.13.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-73212 is a flaw in Coturn TURN/STUN server versions before 4.13.1. It allows authenticated users to bypass IPv4 peer-IP access controls by exploiting IPv6 address canonicalization issues. The server fails to properly normalize IPv4-compatible, 6to4, and NAT64 address forms, enabling attackers to route traffic to restricted internal services via IPv6 formats.

Detection Guidance

To detect this vulnerability, check your Coturn server version. If it is below 4.13.1, the system is vulnerable. Run: coturn --version. Additionally, review logs for unusual relay connections to internal services or cloud metadata endpoints (e.g., 169.254.169.254).

Inspect network traffic for IPv6 addresses encoded as IPv4-mapped, 6to4, or NAT64 formats attempting to bypass ACLs. Use tcpdump or Wireshark to capture relayed traffic and analyze peer IP addresses.

Impact Analysis

An attacker could exploit this to bypass IP restrictions and access sensitive internal services like databases or cloud metadata endpoints. This could lead to unauthorized data access, internal network SSRF, or potential downstream RCE if other services are vulnerable. Requires valid TURN credentials and specific network conditions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized data exposure may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Coturn to version 4.13.1 or later immediately. This version includes fixes for IPv6 address canonicalization and default denials for internal address scopes.

Add explicit IPv6 deny rules for link-local (fe80::/10), ULA (fc00::/7), and site-local (fec0::/10) addresses. Disable TCP relay for RFC 6062 if not required.

Review and update peer IP ACLs to include IPv6 ranges. Monitor logs for any bypass attempts and restrict access to sensitive internal services.

Hi! I’m here to help you understand CVE-2026-73212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70