---
cve: "CVE-2026-27624"
severity: "HIGH"
cvss: 7.2
epss: "25%"
vendor: "coturn"
kev: false
exploited: false
published: "2026-02-25 05:17:25"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-15T17:54:01+02:00"
---

# CVE-2026-27624

> 7.2 HIGH · 🧪 PoC

## Beschreibung

Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Keine | good |

## Patch verfügbar (OSV)

- 41ba6d8f5d073ab27440ef061022eb88123fba62 (Commit)
- b80eb898ba26552600770162c26a8ae7f3661b0b (Commit)

## Referenzen

- <https://github.com/coturn/coturn/security/advisories/GHSA-j8mm-mpf8-gvjg>
- <https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p>
- <https://github.com/coturn/coturn/commit/b80eb898ba26552600770162c26a8ae7f3661b0b>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-27624) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_