CVE-2026-53450: Coturn Auth Bypass Vulnerability

CVE-2026-53450 Overview

Coturn is a widely deployed open source implementation of TURN and STUN servers used in WebRTC and VoIP infrastructure. CVE-2026-53450 affects Coturn versions prior to 4.13.0 and allows authenticated TURN clients to bypass the default loopback peer rejection. Attackers achieve this by supplying an IPv4-mapped IPv6 address such as ::ffff:127.0.0.1 in the TURN XOR-PEER-ADDRESS attribute. The bypass permits relay traffic to reach services bound only to localhost on the Coturn host, enabling server-side request forgery [CWE-918] against internal services.

Critical Impact
Authenticated TURN clients can pivot through Coturn to reach loopback-only services, exposing administrative interfaces and internal APIs that assume trusted local-only access.

Affected Products

Coturn versions prior to 4.13.0
TURN/STUN deployments relying on the default allow-loopback-peers=false setting
WebRTC and VoIP infrastructure using Coturn as a relay

Discovery Timeline

2026-07-10 - CVE-2026-53450 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53450

Vulnerability Analysis

Coturn enforces a loopback peer restriction through the good_peer_addr function, which relies on ioa_addr_is_loopback to detect loopback destinations. When allow-loopback-peers is not enabled, this guard is expected to reject any relay request targeting the local host.

The check inspects the raw address bytes and matches on the literal IPv6 loopback shape (::1) before handling IPv4-mapped IPv6 addresses. An attacker supplying ::ffff:127.0.0.1 triggers the u[15] == 1 branch designed for ::1 and fails the strict comparison, so the address is misclassified as non-loopback. The good_peer_addr gate then approves the peer and Coturn establishes a relay to the local IPv4 stack.

Root Cause

The root cause is an ordering flaw in ioa_addr_is_loopback located in src/client/ns_turn_ioaddr.c. The function evaluates the IPv6 literal loopback branch before applying IN6_IS_ADDR_V4MAPPED handling, leaving IPv4-mapped IPv6 loopback representations outside the loopback classification.

Attack Vector

An authenticated TURN client sends an Allocate or CreatePermission request containing a XOR-PEER-ADDRESS attribute encoding ::ffff:127.0.0.1 (or any ::ffff:127.0.0.0/8 address). Coturn accepts the peer and relays subsequent Send or ChannelData traffic to services listening on the loopback interface, such as admin consoles, metrics endpoints, or unauthenticated internal APIs.

       return (u[0] == 127);
     } else if (addr->ss.sa_family == AF_INET6) {
       const uint8_t *u = ((const uint8_t *)&(addr->s6.sin6_addr));
+      /* IPv4-mapped IPv6: ::ffff:x.x.x.x — check before the ::1 literal branch,
+       * otherwise ::ffff:127.0.0.1 (u[15] == 1) falls into the ::1 path and is
+       * misclassified as non-loopback (GHSA-w4hf-cr3w-6h79). */
+      if (IN6_IS_ADDR_V4MAPPED(&addr->s6.sin6_addr)) {
+        return (u[12] == 127);
+      }
       if (u[15] == 1) {
         int i;
         for (i = 0; i < 15; ++i) {

Source: Coturn security patch commit

The patch adds an IN6_IS_ADDR_V4MAPPED check before the ::1 literal branch, ensuring that mapped IPv4 loopback bytes at offset u[12] are correctly identified as loopback.

Detection Methods for CVE-2026-53450

Indicators of Compromise

TURN allocation or permission requests referencing peer addresses in the ::ffff:127.0.0.0/8 range
Coturn relay sessions with outbound connections to 127.0.0.1 from the Coturn process itself
Unexpected traffic to loopback-bound administrative ports (for example 9000, 8080, 6379) originating from the Coturn service account
Authenticated TURN users generating traffic to internal service ports that do not correspond to normal WebRTC media flows

Detection Strategies

Parse Coturn verbose logs (--verbose) for XOR-PEER-ADDRESS values matching IPv4-mapped IPv6 loopback patterns
Instrument the Coturn host with process-level socket monitoring to flag connections from Coturn to any 127.0.0.0/8 destination
Correlate TURN allocation events with subsequent short-lived TCP or UDP flows to localhost services
Baseline TURN peer address distributions and alert on IPv6 peers containing the ::ffff: prefix followed by loopback octets

Monitoring Recommendations

Forward Coturn logs and host socket telemetry into a centralized data lake for retrospective hunting
Enable audit logging on internal services bound to loopback to capture unexpected client fingerprints
Monitor authentication events for TURN long-term credentials to identify credential abuse preceding relay attempts

How to Mitigate CVE-2026-53450

Immediate Actions Required

Upgrade Coturn to version 4.13.0 or later on all TURN/STUN servers
Audit the running configuration to confirm allow-loopback-peers is not enabled unless explicitly required
Rotate TURN long-term credentials and shared secrets after patching to invalidate any keys held by unknown clients
Inventory services bound to 127.0.0.1 on Coturn hosts and remove or authenticate them where possible

Patch Information

The fix is included in Coturn 4.13.0 and delivered by commit b057acbebe721c8f2f202ddad5e16289e295c754. The change reorders address classification so IN6_IS_ADDR_V4MAPPED runs before the IPv6 literal loopback check. Details are available in the Coturn GHSA-w4hf-cr3w-6h79 advisory.

Workarounds

Add explicit denied-peer-ip=::ffff:127.0.0.0-::ffff:127.255.255.255 entries to the Coturn configuration to block IPv4-mapped loopback peers
Bind sensitive services to a Unix domain socket or an internal-only interface unreachable through the IP stack
Restrict Coturn network egress using host-level firewall rules that block outbound connections from the Coturn process to loopback and private ranges
Disable IPv6 on the Coturn host if IPv6 relay functionality is not required by clients

bash

# Coturn configuration additions (turnserver.conf)
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=::ffff:127.0.0.0-::ffff:127.255.255.255
denied-peer-ip=::1
no-loopback-peers