CVE-2026-73212
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.
Risk Assessment
An attacker can bypass network restrictions and access disallowed IPv4 addresses, potentially leading to unauthorized traffic or network privilege escalation.
Recommendation
Update Coturn to version 4.13.1 or later, which includes the fix.
Original NVD description (English source)
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.