Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-379e214a37 advisory.

    # Coturn 4.9.0

    - Multiple security fixes
    - Fix to Web Admin password check
    - Cleanup of deprecated OpenSSL APIs
    - Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8cb5571ddc advisory.

    # Coturn 4.9.0

    - Multiple security fixes
    - Fix to Web Admin password check
    - Cleanup of deprecated OpenSSL APIs
    - Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2a1aa1f57f advisory.

    # Coturn 4.9.0

    - Multiple security fixes
    - Fix to Web Admin password check
    - Cleanup of deprecated OpenSSL APIs
    - Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to     block loopback and internal ranges using denied-peer-ip and/or default loopback restrictions.
    CVE-2020-26262 addressed bypasses involving 0.0.0.0, [::1] and [::], but IPv4-mapped IPv6 is not     covered. When sending a CreatePermission or ChannelBind request with the XOR-PEER-ADDRESS value of     ::ffff:127.0.0.1, a successful response is received, even though 127.0.0.0/8 is blocked via denied-     peer-ip. The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions     in src/client/ns_turn_ioaddr.c do not check IN6_IS_ADDR_V4MAPPED. ioa_addr_is_loopback() checks     127.x.x.x (AF_INET) and ::1 (AF_INET6), but not ::ffff:127.0.0.1. ioa_addr_is_zero() checks     0.0.0.0 and ::, but not ::ffff:0.0.0.0. addr_less_eq() used by ioa_addr_in_range() for denied-     peer-ip matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without     extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for     CVE-2020-26262. (CVE-2026-27624)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301452	Fedora 44 : coturn (2026-379e214a37)	Nessus	Fedora Local Security Checks	medium
301071	Fedora 43 : coturn (2026-8cb5571ddc)	Nessus	Fedora Local Security Checks	medium
301070	Fedora 42 : coturn (2026-2a1aa1f57f)	Nessus	Fedora Local Security Checks	medium
299987	Linux Distros Unpatched Vulnerability : CVE-2026-27624	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-27624

medium

Tenable Plugins

medium

medium

medium

medium