CVE-2026-73213

Received Received - Intake

Coturn IPv6 Address Range Bypass in TURN/STUN Server

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73213

EUVD

EUVD-2026-56819

Affected Vendors & Products

Vendor	Product	Version / Range
coturn	coturn	to 4.16.0 (exc)
coturn	coturn	4.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-73213 is a vulnerability in Coturn, a TURN and STUN server, affecting versions up to 4.15.0. It involves a flawed IPv6 address comparison function, addr_less_eq(), which uses component-wise comparison instead of lexicographic ordering. This allows authenticated TURN clients to bypass IPv6 peer IP range restrictions, enabling unauthorized relay to restricted IPv6 peers.

Detection Guidance

To detect this vulnerability, check your Coturn server version. If it is below 4.16.0, it is vulnerable. Run: turnserver --version. Additionally, review your denied-peer-ip and allowed-peer-ip configurations for non-prefix-aligned IPv6 ranges.

Impact Analysis

The vulnerability allows an authenticated attacker to bypass IPv6 peer IP restrictions, potentially accessing restricted internal IPv6 services through the TURN relay. This could lead to unauthorized access or data exfiltration, depending on the services exposed. The impact depends on the downstream services accessible via the TURN server.

Compliance Impact

This vulnerability allows an authenticated TURN client to bypass IPv6 peer IP restrictions, potentially enabling unauthorized access to restricted services. While not directly tied to GDPR or HIPAA, such unauthorized access could lead to data breaches or exposure of sensitive information, which may violate compliance requirements for data protection and privacy.

Mitigation Strategies

Upgrade Coturn to version 4.16.0 or later immediately. If upgrading is not possible, avoid using non-prefix-aligned IPv6 min-max ranges in denied-peer-ip or allowed-peer-ip configurations.

Hi! I’m here to help you understand CVE-2026-73213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70