CVE-2026-73213: Coturn Auth Bypass Vulnerability

CVE-2026-73213 Overview

Coturn, a widely deployed open source TURN and STUN server, contains an authorization flaw in versions prior to 4.16.0. The addr_less_eq() function in src/client/ns_turn_ioaddr.c performs a component-wise per-byte comparison when evaluating native IPv6 min-max intervals in ioa_addr_in_range(). An authenticated TURN client can relay traffic to an IPv6 peer that falls numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. The result is a bypass of denied-peer-ip access controls for IPv6 relay targets. The issue is fixed in version 4.16.0 and is categorized as an incorrect authorization weakness [CWE-863].

Critical Impact
An authenticated TURN client can bypass IPv6 denied-peer-ip range restrictions, relaying traffic to peers that should be blocked by administrator policy.

Affected Products

Coturn TURN/STUN Server versions prior to 4.16.0
Deployments using IPv6 denied-peer-ip ranges that are not prefix-aligned
Coturn 4.16.0 contains the fix

Discovery Timeline

2026-08-11 - CVE-2026-73213 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73213

Vulnerability Analysis

Coturn enforces peer relay policy through denied-peer-ip ranges, which administrators use to prevent TURN clients from relaying to sensitive internal addresses. The range check in ioa_addr_in_range() calls addr_less_eq() to test whether a candidate peer address falls between a min and max bound. For IPv4, the comparison is a linear 32-bit integer test. For IPv6, the vulnerable implementation iterates all 16 bytes and returns false as soon as any single byte in the candidate exceeds the corresponding byte in the bound.

This per-byte logic defines a rectangular product region across each byte position rather than a contiguous lexicographic interval. When an administrator configures a non-prefix-aligned IPv6 range, addresses that are numerically inside the intended interval can be classified as outside it, because one intermediate byte falls above the corresponding byte of max even though earlier bytes place the address strictly below max. Authenticated attackers exploit this gap to reach denied peer targets.

Root Cause

The defect is a logic error in interval comparison for 128-bit IPv6 addresses. The in6_addr structure stores bytes MSB-first (network byte order), so the correct total order over the interval is lexicographic, implemented by memcmp. The prior code treated each byte as an independent dimension, producing an incorrect containment predicate for any range that does not align to a byte boundary.

Attack Vector

Exploitation requires valid TURN credentials. The attacker allocates a relay on the Coturn server and requests a peer permission or channel binding for an IPv6 address the operator intended to deny. If the target address sits inside a non-prefix-aligned denied range but outside the buggy rectangular region, Coturn permits the relay. The attacker can then use the TURN server as a network pivot to reach otherwise restricted IPv6 destinations.

     } else if (addr1->ss.sa_family == AF_INET) {
       return ((uint32_t)nswap32(addr1->s4.sin_addr.s_addr) <= (uint32_t)nswap32(addr2->s4.sin_addr.s_addr));
     } else if (addr1->ss.sa_family == AF_INET6) {
-      int i;
-      for (i = 0; i < 16; i++) {
-        if ((uint8_t)(((const char *)&(addr1->s6.sin6_addr))[i]) >
-            (uint8_t)(((const char *)&(addr2->s6.sin6_addr))[i])) {
-          return 0;
-        }
-      }
-      return 1;
+      /* in6_addr is stored MSB-first (network order), so a byte-wise memcmp is
+       * the lexicographic total order. A component-wise per-byte comparison
+       * would test a rectangular box, not the contiguous span [min,max], and
+       * under-block IPv6 denied-peer-ip ranges. */
+      return memcmp(&(addr1->s6.sin6_addr), &(addr2->s6.sin6_addr), 16) <= 0;
     } else {
       return 1;
     }

Source: Coturn commit 6c13608c28a04af5d63abddd7565a0dcc4771c28. The patch replaces the per-byte loop with a single memcmp over the 16-byte address, restoring the correct lexicographic ordering.

Detection Methods for CVE-2026-73213

Indicators of Compromise

TURN allocations from authenticated clients issuing CreatePermission or ChannelBind requests targeting IPv6 addresses that overlap operator-defined denied-peer-ip ranges.
Outbound relay traffic from the Coturn host to internal IPv6 destinations that should be blocked by policy.
Unexpected relay sessions to IPv6 addresses immediately adjacent to configured range boundaries.

Detection Strategies

Audit Coturn logs for permission and channel-binding events, then correlate destination IPv6 addresses against the intended denied ranges using a lexicographic comparison rather than per-byte logic.
Deploy network flow monitoring at the Coturn egress path to identify relay traffic to sensitive IPv6 prefixes.
Verify the running Coturn version reported by turnserver -h or package inventory against the fixed release 4.16.0.

Monitoring Recommendations

Ingest Coturn access and session logs into a centralized log platform and alert on relays targeting internal IPv6 ranges.
Track authenticated TURN sessions per credential and flag accounts creating permissions for a large or unusual set of IPv6 peers.
Baseline expected IPv6 relay destinations and alert on deviations.

How to Mitigate CVE-2026-73213

Immediate Actions Required

Upgrade Coturn to version 4.16.0 or later on all TURN/STUN servers.
Rotate long-term TURN credentials and shared secrets if unauthorized IPv6 relays are suspected.
Review and, where possible, restate denied-peer-ip ranges as prefix-aligned CIDR blocks to reduce reliance on arbitrary min-max intervals.

Patch Information

The fix is included in Coturn release 4.16.0. Technical details are documented in GitHub Security Advisory GHSA-4v97-rxjj-4f99, and the code change is available in the upstream commit, which replaces the byte-wise loop with memcmp over the full 16-byte IPv6 address.

Workarounds

Replace non-prefix-aligned IPv6 denied-peer-ip ranges with equivalent prefix-aligned CIDR entries where the byte-wise and lexicographic checks converge.
Enforce upstream network ACLs on the Coturn host to block egress to sensitive IPv6 destinations independent of the TURN policy engine.
Restrict TURN authentication to trusted users and disable anonymous or shared long-term credentials until patched.

bash

# Verify Coturn version and confirm the fix is applied
turnserver -h | head -n 1

# Example prefix-aligned denied-peer-ip entries in turnserver.conf
denied-peer-ip=2001:db8::/32
denied-peer-ip=fc00::/7
denied-peer-ip=fe80::/10