← CVE Radar
CVE-2026-123017
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
6.5 MEDIUMEPSS 0.25%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.5 | MEDIUM | 3.1mitre (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Details
- CVE ID
- CVE-2026-123017
- Status
- Received
- Assigner (CNA)
- mitre
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 22:17 UTC
- Weaknesses
- CWE-290 · Authentication Bypass by Spoofing
Affected Products
As published by the CNA in the CVE record.
godotsteamGodotSteam1 version range
- 4.17.0 through 4.23.2
References
- axeghost.offprint.app https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game
- codeberg.org https://codeberg.org/godotsteam/godotsteam
- github.com https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim
- openwall.com https://www.openwall.com/lists/oss-security/2026/11/04/11
- openwall.com http://www.openwall.com/lists/oss-security/2026/11/05/5