Vulnerability record · CVE-2026-53450 · published 10 July 2026

CVE-2026-53450: Coturn project coturn server-side request forgery (ssrf) vulnerability

Coturn Project · Coturn

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

7.4 CVSS 3.1 High EPSS 0.29% · top 80.6% CWE-918 · Server-side request forgery (SSRF)

7.4CVSS 3.1 base score

0.29%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

16 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Coturn Coturn Project

References

Link	Tags
https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754	Patch
https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79	Third Party Advisory
https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79	Third Party Advisory

Track CVE-2026-53450 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-43994Coturn project coturn classic buffer overflow vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_g…EPSS 0.68%18 Jun 2026 9.8CVE-2020-6061Coturn project coturn out-of-bounds read vulnerabilityAn exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST …EPSS 5.1%19 Feb 2020 9.8CVE-2018-4059Coturn project coturn missing authorization vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN…EPSS 1.9%21 Mar 2019 9.8CVE-2018-4056Coturn project coturn sql injection vulnerabilityAn exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a…EPSS 3.0%5 Feb 2019 7.7CVE-2018-4058Coturn project coturn vulnerabilityAn exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN se…EPSS 0.92%21 Mar 2019 7.5CVE-2026-40613Coturn project coturn vulnerabilityCoturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform uns…EPSS 1.5%21 Apr 2026 7.5CVE-2020-4067Coturn project coturn vulnerabilityIn coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information bet…EPSS 1.9%29 Jun 2020 7.5CVE-2020-6062Coturn project coturn null pointer dereference vulnerabilityAn exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST reques…EPSS 6.1%19 Feb 2020

Source: NIST National Vulnerability Database (record CVE-2026-53450), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.