Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-53450Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection

High 7.4

In plain English

A high-severity server-side request forgery in coturn from coturn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-53450
Debian:13coturnno fix listedDEBIAN-CVE-2026-53450
Debian:14coturn4.14.0-1DEBIAN-CVE-2026-53450
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-53450
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-53450
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-53450
Ubuntu:26.10coturnno fix listedUBUNTU-CVE-2026-53450

Affected products (as reported)

VendorProductVersions
coturn coturn < 4.13.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References