PT-2026-21865 · Coturn · Coturn

T1Xster-Secreporter · Published 2026-02-23 · Updated 2026-03-15 · CVE-2026-27624

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.9.0

Description Coturn, a free open source implementation of TURN and STUN Server, is susceptible to a bypass of loopback and internal range restrictions. Specifically, configurations using "denied-peer-ip" to block loopback and internal ranges can be circumvented by sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value set to "::ffff:127.0.0.1". This is due to insufficient checks for IPv4-mapped IPv6 addresses in the functions ioa addr is loopback(), ioa addr is zero(), and addr less eq() within "src/client/ns turn ioaddr.c" prior to version 4.9.0. The root cause is that these functions do not check for IN6 IS ADDR V4MAPPED.

Recommendations Versions prior to 4.9.0 should be updated to version 4.9.0 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-441

CWE-284

Related Identifiers

BDU:2026-04350

CVE-2026-27624

GHSA-6G6J-R9RF-CM7P

GHSA-J8MM-MPF8-GVJG

MGASA-2026-0051

OPENSUSE-SU-2026:10375-1

Affected Products

Coturn

References · 25

• 🔥 https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjg · Exploit
• 🔥 https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27624.json · Exploit
• https://github.com/coturn/coturn/commit/b80eb898ba26552600770162c26a8ae7f3661b0b · Patch
• https://osv.dev/vulnerability/MGASA-2026-0051 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27624 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27624 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27624 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27624 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27624 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/37LHFMZ3OPUJRL3DZ3WVCJ7FO62HMVUT · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27624 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27624 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0051.html · Security Note
• https://bdu.fstec.ru/vul/2026-04350 · Security Note