CVE-2026-73212 coturn CVE debrief

Who should care

Defenders responsible for Coturn installations, especially those with IPv4 denied-peer-ip ranges configured, should assess exposure and verify their Coturn versions. Additionally, security teams and vulnerability management teams should review their asset inventory to ensure all Coturn installations are accounted for and remediated. Platform operators and administrators should also review their Coturn configurations to ensure IPv4 denied-peer-ip ranges are

Why it matters

CVE-2026-73212 is a medium-severity vulnerability in Coturn that allows authenticated clients to bypass IPv4 denied-peer-ip ranges. Defenders should verify Coturn installations and update to version 4.13.1 or later.

• Potential bypass of IPv4 denied-peer-ip ranges by authenticated clients
• Possible exposure of Coturn installations to unauthorized access

Technical summary

The vulnerability occurs because the good_peer_addr() function in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. The issue affects Coturn installations prior to version 4.13.1, and defenders should verify their Coturn versions and configurations to ensure they are not exposed to this vulnerability.

Defensive priority

Defenders should prioritize verifying Coturn installations, especially those with IPv4 denied-peer-ip ranges configured, and ensure they are updated to version 4.13.1 or later.

Recommended defensive actions

• Verify Coturn installations and ensure they are updated to version 4.13.1 or later.
• Review Coturn configurations to ensure IPv4 denied-peer-ip ranges are properly set and functioning.
• Monitor Coturn logs for potential bypass attempts.
• Perform a thorough review of Coturn installations to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved.
• Review asset inventory to ensure all Coturn installations are accounted for and remediated.

Evidence notes

The CVE record and source references provide details on the vulnerability, its impact, and the fix. However, the corpus does not establish versions prior to 4.13.1 that are affected or confirm exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.