CVE-2026-73213 in Coturn
Summary
by MITRE • 08/11/2026
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The coturn server represents a critical component in network infrastructure serving as an implementation of the TURN and STUN protocols essential for NAT traversal in real-time communication applications. This vulnerability specifically affects versions prior to 4.16.0 where a flaw exists in the address validation logic within the ns_turn_ioaddr.c source file. The issue manifests through the addr_less_eq() function which performs component-wise comparison operations on native IPv6 min-max intervals during peer validation checks. When an authenticated TURN client attempts to establish a relay connection, the system evaluates whether the target IPv6 peer falls within configured denied peer IP ranges.
The technical flaw stems from improper handling of non-prefix-aligned IPv6 address ranges where the implementation fails to correctly identify when an IPv6 address lies within a specified range that does not align with standard IPv6 prefix boundaries. This occurs during the ioa_addr_in_range() function execution where the component-wise comparison logic incorrectly classifies certain IPv6 addresses as being outside a denied range when they are actually numerically contained within it. The vulnerability allows for a bypass of access control mechanisms that should prevent connections to specific IPv6 peers based on configured restrictions.
This security issue presents significant operational impact for organizations relying on coturn servers for their communication infrastructure. An authenticated attacker could potentially circumvent network access controls and establish relay connections to IPv6 addresses that should be blocked, thereby undermining the intended security boundaries of the TURN server configuration. The vulnerability essentially creates a tunneling mechanism that allows unauthorized access to restricted IPv6 networks while maintaining the appearance of legitimate authentication through the TURN protocol.
The flaw aligns with CWE-129 weakness category related to improper validation of array indices and demonstrates characteristics consistent with privilege escalation vulnerabilities in network services. From an ATT&CK framework perspective, this vulnerability could enable initial access or lateral movement within network environments where coturn servers serve as relay points for communication traffic. The impact extends beyond simple access control bypass as it may allow for data exfiltration or further exploitation of network resources that would otherwise be protected by the configured denied peer restrictions.
Organizations should immediately upgrade to coturn version 4.16.0 or later to remediate this vulnerability. The fix addresses the core issue in the address comparison logic by implementing proper IPv6 range validation that correctly handles non-prefix-aligned address ranges. System administrators should also review existing peer access control configurations and audit network logs for any suspicious activity that may have occurred during the vulnerable period. Additional security measures including network segmentation, monitoring of TURN server traffic, and regular vulnerability assessments should be implemented to maintain overall network security posture while ensuring proper access controls remain effective against similar issues in other network services.