CVE-2026-73213 coturn CVE debrief

Who should care

Defenders responsible for Coturn installations and configurations should assess exposure and prioritize updating to version 4.16.0 if necessary. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review configurations, monitor logs, and ensure proper setup of denied-peer-ip ranges.

Why it matters

CVE-2026-73213 is a medium-severity vulnerability in Coturn that allows an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. Defenders should prioritize verifying Coturn installations and updating to version 4.16.0 if necessary.

• Potential unauthorized relaying of TURN traffic to IPv6 peers
• Possible bypass of configured denied-peer-ip ranges
• Need to verify Coturn configurations and update to version 4.16.0

Technical summary

The vulnerability is caused by a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range() in src/client/ns_turn_ioaddr.c, allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue affects Coturn versions prior to 4.16.0 and can be mitigated by updating to the latest version. The vulnerability has a medium severity and defenders should prioritize verifying Coturn installations.

Defensive priority

Defenders should prioritize verifying Coturn installations and updating to version 4.16.0 if necessary.

Recommended defensive actions

• Verify Coturn installations and update to version 4.16.0 if necessary
• Review Coturn configurations to ensure proper setup of denied-peer-ip ranges
• Monitor Coturn logs for potential exploitation attempts
• Confirm whether affected Coturn deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The fix is available in Coturn version 4.16.0. Defenders should verify Coturn installations, review configurations, and monitor logs for potential exploitation attempts. Evidence is limited to public sources and may not be comprehensive. Further verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.