CVE-2026-73216: Coturn Auth Bypass Vulnerability

CVE-2026-73216 Overview

Coturn is a widely deployed open-source implementation of the Traversal Using Relays around NAT (TURN) and Session Traversal Utilities for NAT (STUN) protocols. CVE-2026-73216 affects Coturn versions prior to 4.17.0. The vulnerability resides in the shutdown_client_connection() function within src/server/ns_turn_server.c. During the first-stage close of a mobility-enabled allocation, the function prematurely calls dec_quota() and releases bandwidth accounting while preserving the allocation, relay socket, session, and mobility ticket. An authenticated client can abuse this behavior to bypass --user-quota and --total-quota limits and exhaust relay ports on the server.

Critical Impact
Authenticated attackers can exhaust relay port resources on Coturn servers, causing denial of service for legitimate TURN clients that rely on relay services for WebRTC and real-time communications.

Affected Products

Coturn TURN/STUN Server versions prior to 4.17.0
Deployments using mobility-enabled TURN allocations
Services relying on Coturn for WebRTC relay (video conferencing, VoIP platforms)

Discovery Timeline

2026-08-11 - CVE-2026-73216 published to NVD
2026-08-11 - Last updated in NVD database
Version 4.17.0 - Coturn releases patched version resolving the issue

Technical Details for CVE-2026-73216

Vulnerability Analysis

The flaw is an uncontrolled resource consumption issue [CWE-400] in the Coturn session shutdown path. Coturn supports client mobility, which allows a client to migrate an existing allocation to a new session by presenting a mobility ticket. To enable this handoff, the shutdown routine performs a two-stage close: the first stage tears down the old session's network binding while retaining the allocation, relay socket, and mobility ticket so the client can resume.

The defect lies in the ordering of accounting cleanup. shutdown_client_connection() invokes dec_quota() and releases bandwidth accounting during the first stage, even though the allocation and relay port still exist. An authenticated client that repeatedly triggers the first-stage close cycle can cause the server to release its quota charge while retaining the underlying relay resources. Each iteration allows the client to acquire additional allocations without being counted against --user-quota or --total-quota, ultimately exhausting available relay ports.

Root Cause

The root cause is premature quota release relative to actual resource deallocation. Quota accounting must reflect the lifetime of the underlying relay socket, not the lifetime of the client-facing session. Because mobility keeps the allocation alive across the first-stage close, decrementing the quota at that point desynchronizes accounting from real resource usage.

Attack Vector

Exploitation requires valid TURN credentials, so the attacker must be authenticated to the Coturn service. The attacker establishes a mobility-enabled allocation, triggers the first-stage close of that session while retaining the mobility ticket, and repeats the process. Because each cycle releases quota without releasing the relay port, the attacker accumulates relay allocations until the server's port pool is exhausted, denying service to legitimate clients.

   return 0;
 }
 
-static void copy_auth_parameters(ts_ur_super_session *orig_ss, ts_ur_super_session *ss) {
+/* Copy orig_ss's auth context onto ss. acquire_quota controls whether ss takes
+ * an allocation quota unit under the copied identity: pass true when ss is the
+ * session that will own the allocation, false when orig_ss already holds the
+ * allocation's single quota unit (a mobility resume, where ss is only the
+ * temporary resuming session and must not be charged a second time). In both
+ * cases any stale charge ss held under its previous identity is released first. */
+static void copy_auth_parameters(ts_ur_super_session *orig_ss, ts_ur_super_session *ss, bool acquire_quota) {
   if (orig_ss && ss) {
     dec_quota(ss);
     memcpy(ss->nonce, orig_ss->nonce, sizeof(ss->nonce));

Source: Coturn commit 3c5b2615. The patch introduces an explicit acquire_quota flag so that mobility resume paths do not double-charge quota and non-resume paths correctly acquire quota units, aligning accounting with allocation lifetime.

Detection Methods for CVE-2026-73216

Indicators of Compromise

Sustained growth of active TURN allocations from a single authenticated user beyond configured --user-quota limits.
Server logs showing repeated mobility-ticket resume cycles from the same client identity in short intervals.
Exhaustion of relay UDP ports while active session counts appear below configured quota thresholds.

Detection Strategies

Correlate dec_quota and allocation-create events per user to identify accounting drift where quota releases exceed genuine session terminations.
Alert when a single authenticated principal holds more concurrent relay ports than --user-quota permits.
Monitor for anomalous ratios of mobility resume operations to standard TURN allocation flows.

Monitoring Recommendations

Enable verbose Coturn logging (--verbose) and forward logs to a centralized SIEM for authentication and allocation telemetry.
Track relay port pool utilization as a first-class metric and alert on rapid consumption trends.
Baseline normal TURN client behavior per tenant so quota-bypass patterns stand out against expected traffic.

How to Mitigate CVE-2026-73216

Immediate Actions Required

Upgrade Coturn to version 4.17.0 or later, which fixes the premature quota release in shutdown_client_connection().
Audit TURN user credentials and revoke any long-lived shared secrets that could be abused by authenticated attackers.
Review current --user-quota and --total-quota values and lower them where operationally acceptable to reduce blast radius.

Patch Information

The fix is available in Coturn 4.17.0. See the GitHub Security Advisory GHSA-f6hc-79w3-p8pq, the Coturn 4.17.0 release notes, and the upstream patch commit for full technical details.

Workarounds

Disable mobility support if the deployment does not require session migration, removing the code path that triggers the flaw.
Restrict TURN authentication to trusted, short-lived credentials issued by an authorization service that can revoke abusive users quickly.
Place Coturn behind rate limiting or connection throttling to slow the rate at which any single principal can create and tear down allocations.

bash

# Verify installed Coturn version
turnserver -h | head -n 1

# Example: enforce stricter quotas in turnserver.conf
user-quota=10
total-quota=1200

# After upgrade, restart the service
sudo systemctl restart coturn