CVE-2026-27624

Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

• CWE-284
• CWE-441

• https://github.com/coturn/coturn/commit/b80eb898ba26552600770162c26a8ae7f3661b0bPatch
• https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7pNot Applicable
• https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjgExploit, Vendor Advisory
• https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7pNot Applicable
• https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjgExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27615ADB Explorer is a fluent UI for ADB on Windows. In versions …7.8
• CVE-2026-27616Vikunja is an open-source self-hosted task management platfo…7.3
• CVE-2026-2762Integer overflow in the JavaScript: Standard Library compone…9.8
• CVE-2026-27621TypiCMS is a multilingual content management system based on…5.4
• CVE-2026-27622OpenEXR provides the specification and reference implementat…7.8
• CVE-2026-27623Valkey is a distributed key-value database. Starting in vers…7.5
• CVE-2026-27625Stirling-PDF is a locally hosted web application that perfor…6.5
• CVE-2026-27626OliveTin gives access to predefined shell commands from a we…9.9
• CVE-2026-27627Karakeep is a elf-hostable bookmark-everything app. In versi…6.1
• CVE-2026-27628pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
• CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8