PT-2026-53972 · Coturn · Coturn

Published 2026-06-30 · Updated 2026-07-10 · CVE-2026-53450

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions coturn versions prior to 4.13.0

Description An authenticated TURN client can bypass the default loopback guard by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 within a TURN XOR-PEER-ADDRESS attribute. This occurs because the ioa addr is loopback function checks for the literal IPv6 loopback shape before handling IPv4-mapped IPv6 addresses, causing the good peer addr function to fail in applying the default loopback rejection. Consequently, an attacker can expose services bound only to localhost on the host through TURN relay traffic.

Recommendations Update to version 4.13.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-53450

Affected Products

Coturn

References · 4

• 🔥 https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-53450 · Security Note
• https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754 · Note
• https://twitter.com/enablesecurity/status/2071961109964161082 · Twitter Post