UBUNTU-CVE-2026-53450
Coturn versions prior to 4.13.0 contain a vulnerability where the default loopback peer rejection can be bypassed by using an IPv4-mapped IPv6 address (::ffff:127.0.0.1) in a TURN XOR-PEER-ADDRESS attribute. This allows an authenticated TURN client to relay traffic to services bound only to localhost on the coturn host. The issue is fixed in version 4.13.0.
AI Analysis
Technical Summary
Coturn, an open source TURN and STUN server, prior to version 4.13.0, improperly handles loopback peer addresses. The function ioa_addr_is_loopback checks for literal IPv6 loopback addresses before handling IPv4-mapped IPv6 addresses, allowing the bypass of the default loopback rejection. An authenticated TURN client can exploit this by specifying the IPv4-mapped IPv6 address ::ffff:127.0.0.1 in the XOR-PEER-ADDRESS attribute, potentially exposing localhost-bound services through TURN relay traffic. This vulnerability is resolved in coturn version 4.13.0.
Potential Impact
An authenticated TURN client can bypass the default loopback peer rejection and relay traffic to services bound to localhost on the coturn host. This could lead to unauthorized access or exposure of local services that are not intended to be accessible externally. The impact includes potential confidentiality, integrity, and availability loss as indicated by the CVSS vector.
Mitigation Recommendations
Upgrade coturn to version 4.13.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in 4.13.0.
UBUNTU-CVE-2026-53450
Description
Coturn versions prior to 4.13.0 contain a vulnerability where the default loopback peer rejection can be bypassed by using an IPv4-mapped IPv6 address (::ffff:127.0.0.1) in a TURN XOR-PEER-ADDRESS attribute. This allows an authenticated TURN client to relay traffic to services bound only to localhost on the coturn host. The issue is fixed in version 4.13.0.
CVSS v3.1
Score 7.4high
Affected software
pkg:deb/ubuntu/[email protected]?arch=source&distro=xenialpkg:deb/ubuntu/[email protected]?arch=source&distro=bionicpkg:deb/ubuntu/[email protected]?arch=source&distro=focalpkg:deb/ubuntu/[email protected]~ubuntu22.04.1?arch=source&distro=jammypkg:deb/ubuntu/[email protected]?arch=source&distro=noblepkg:deb/ubuntu/[email protected]?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Coturn, an open source TURN and STUN server, prior to version 4.13.0, improperly handles loopback peer addresses. The function ioa_addr_is_loopback checks for literal IPv6 loopback addresses before handling IPv4-mapped IPv6 addresses, allowing the bypass of the default loopback rejection. An authenticated TURN client can exploit this by specifying the IPv4-mapped IPv6 address ::ffff:127.0.0.1 in the XOR-PEER-ADDRESS attribute, potentially exposing localhost-bound services through TURN relay traffic. This vulnerability is resolved in coturn version 4.13.0.
Potential Impact
An authenticated TURN client can bypass the default loopback peer rejection and relay traffic to services bound to localhost on the coturn host. This could lead to unauthorized access or exposure of local services that are not intended to be accessible externally. The impact includes potential confidentiality, integrity, and availability loss as indicated by the CVSS vector.
Mitigation Recommendations
Upgrade coturn to version 4.13.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in 4.13.0.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-53450
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b47c68715ace43d9e9e4
Added to database: 07/16/2026, 10:37:48 UTC
Last enriched: 07/16/2026, 11:54:44 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.