The Coturn TURN and STUN server implementation is vulnerable to an access control bypass that allows attackers to reach restricted internal network resources via crafted IPv4-mapped IPv6 addresses.

This vulnerability involves improper access control (CWE-284) and a confused deputy scenario (CWE-441) where the application fails to validate IPv4-mapped IPv6 addresses against configured denied-peer-ip lists. An unauthenticated attacker can bypass existing security restrictions by crafting specific TURN requests containing addresses such as ::ffff:127.0.0.1.

Successful exploitation allows an unauthenticated attacker to interact with services on the internal network or the local loopback interface that were intended to be protected by the Coturn access control configuration. With a CVSS score of 7.2, this represents a high-risk security flaw that could lead to unauthorized data access or the exploitation of internal-only management interfaces, potentially resulting in significant reputational damage and data compromise.

Immediate Action: Upgrade the Coturn implementation to version 4.9.0 or later to ensure the correct handling of IPv4-mapped IPv6 addresses in access control functions.

Proactive Monitoring: Monitor server access logs for TURN requests containing anomalous IPv6 addresses, specifically those using the ::ffff: prefix, which may indicate attempts to probe internal network boundaries.

Compensating Controls: If an immediate update is not feasible, ensure that network-level firewalls strictly limit the ability of the Coturn server to initiate connections to internal or loopback IP ranges, effectively isolating the service from sensitive internal resources.

Public Exploit Available: Unknown.

Given the potential for unauthorized access to internal resources, organizations running Coturn should prioritize updating to version 4.9.0. The ability for an unauthenticated user to bypass network restrictions elevates the urgency of this remediation, and administrators should verify their current deployment versions immediately to assess their exposure.