CVE-2026-27624 Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL
Attackers can bypass denied-peer-ip ACLs in Coturn by using IPv4-mapped IPv6 addresses, allowing connections to blocked internal ranges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27624?
CVE-2026-27624 is a high-severity vulnerability in coturn, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.
Which versions are affected by CVE-2026-27624?
It affects 1 product.
Products include Coturn Project Coturn.
How do I fix CVE-2026-27624?
Upgrade to a fixed version.
Is CVE-2026-27624 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27624 exists.
Other vulnerabilities in coturn
- CVE-2018-4056 SQL injection in coTURN
- CVE-2026-43994 Coturn: Stack buffer overflow in decode_oauth_token_gcm()
- CVE-2018-4058 Server-side request forgery in coTURN
- CVE-2026-40613 Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)
- CVE-2026-53450 Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
Sources
Also known as DEBIAN-CVE-2026-27624, MGASA-2026-0051, UBUNTU-CVE-2026-27624.