CVE-2026-53450: coturn project coturn

csirt@kutim:~/threat-intel/cve/CVE-2026-53450

CVSS 7.4 · High EPSS 0,29%

Kerentanan Server-Side Request Forgery (SSRF) pada coturn project coturn. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 handling, so good_peer_addr does not apply the default loopback rejection and an authenticated TURN client can expose services bound only to localhost on the coturn host through TURN relay traffic. This issue is fixed in version 4.13.0.

Rincian

Terbit di NVD: 10 Juli 2026
Terakhir diubah: 16 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.4 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,29% peluang dieksploitasi; lebih tinggi dari 20,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
coturn project	coturn	Semua versi sebelum 4.13.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/coturn/coturn/commit/b057acbebe721c8f2f202ddad5e16289e295c754 patch
https://github.com/coturn/coturn/security/advisories/GHSA-w4hf-cr3w-6h79 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.