CVE-2018-4058

An exploitable unsafe default configuration vulnerability exists in the
TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN
server allows relaying external traffic to the loopback interface of its
own host. This can provide access to other private services running on that
host, which can lead to further attacks. An attacker can set up a relay
with a loopback address as the peer on an affected TURN server to trigger
this vulnerability.