CVE-2020-26262
published 2021-01-13CVE-2020-26262: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to…
PriorityP342high7.2CVSS 3.1
AVNACLPRNUINSCCLILAN
EPSS
1.28%
66.4th percentile
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| coturn | coturn | < 4.9.0 | 4.9.0 |
| coturn_project | coturn | < 4.5.2 | 4.5.2 |
| coturn_project | coturn | < 4.9.0 | 4.9.0 |
| coturn_project | coturn | >= 0 < 4.5.2-1 | 4.5.2-1 |
| coturn_project | coturn | >= 0 < 4.5.2-1 | 4.5.2-1 |
| coturn_project | coturn | >= 0 < 4.5.2-1 | 4.5.2-1 |
| coturn_project | coturn | >= 0 < 4.5.2-1 | 4.5.2-1 |
| debian | coturn | < coturn 4.5.2-1 (bookworm) | coturn 4.5.2-1 (bookworm) |
| debian | coturn | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv7.2HIGH
vendor_debian7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-27624: coturn - Coturn is a free open source implementation of TURN and STUN Server. Coturn is c...
vendor_debian·2026·CVSS 7.2
CVE-2026-27624 [HIGH] CVE-2026-27624: coturn - Coturn is a free open source implementation of TURN and STUN Server. Coturn is c...
Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_i
Ubuntu
coTURN vulnerability
vendor_ubuntu·2021-01-11
CVE-2020-26262 coTURN vulnerability
Title: coTURN vulnerability
Summary: coTURN could be made to crash or run programs if it received
specially crafted network traffic.
It was discovered that coTURN allowed peers to connect and relay packets to
loopback addresses in the range of 127.x.x.x. A malicious user could use this
vulnerability to insert packages into the loopback interface.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-26262: coturn - Coturn is free open source implementation of TURN and STUN Server. Coturn before...
vendor_debian·2020·CVSS 7.2
CVE-2020-26262 [HIGH] CVE-2020-26262: coturn - Coturn is free open source implementation of TURN and STUN Server. Coturn before...
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--den
OSV
CVE-2026-27624: Coturn is a free open source implementation of TURN and STUN Server
osv·2026-02-25·CVSS 7.2
CVE-2026-27624 [HIGH] CVE-2026-27624: Coturn is a free open source implementation of TURN and STUN Server
Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_i
OSV
CVE-2020-26262: Coturn is free open source implementation of TURN and STUN Server
osv·2021-01-13·CVSS 7.2
CVE-2020-26262 [HIGH] CVE-2020-26262: Coturn is free open source implementation of TURN and STUN Server
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--den
No detection rules found.
No public exploits indexed.
https://github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog#L48https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4dhttps://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7phttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G54UIUFTEC6RLPOISMB6FUW7456SBZC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4CJOPAQT43MYAFU3UROGLEXN3Z6RS4H/https://github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog#L48https://github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4dhttps://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7phttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G54UIUFTEC6RLPOISMB6FUW7456SBZC4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4CJOPAQT43MYAFU3UROGLEXN3Z6RS4H/
2021-01-13
Published