CVE-2026-53450

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

• CWE-918

• https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754Patch
• https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79Third Party Advisory
• https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79Third Party Advisory

Published

Jul 10, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53444Wekan is open source kanban built with Meteor. Prior to 9.32…7.6
• CVE-2026-53445Wekan is open source kanban built with Meteor. Prior to 9.32…7.1
• CVE-2026-53446Wekan is open source kanban built with Meteor. Prior to 9.32…6.2
• CVE-2026-53447Wekan is open source kanban built with Meteor. Prior to 9.35…6.5
• CVE-2026-53448Coturn is a free open source implementation of TURN and STUN…7.2
• CVE-2026-53449Coturn is a free open source implementation of TURN and STUN…6
• CVE-2026-5346A vulnerability was determined in huimeicloud hm_editor up t…7.3
• CVE-2026-53460ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-53461ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-53462ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-53463ImageMagick is free and open-source software used for editin…4.3
• CVE-2026-53464ImageMagick is free and open-source software used for editin…4