cve-2026-123017

MEDIUM CVSS 6.5 fkie_nvd
Description

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Affected Products

No product information available.

Weaknesses (CWE)
CWE-290
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 3.9 2.5 cve@mitre.org
NVD metadata
NVD status
Received
Source identifier
cve@mitre.org
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "SteamMultiplayerPeer"
          ],
          "product": "GodotSteam",
          "programFiles": [
            "src/godotsteam_multiplayer_peer.cpp",
            "src/steam_packet_peer.cpp"
          ],
          "programRoutines": [
            {
              "name": "SteamMultiplayerPeer::upgrade_peer"
            },
            {
              "name": "SteamPacketPeer::set_peer_id"
            }
          ],
          "repo": "https://codeberg.org/godotsteam/godotsteam",
          "vendor": "godotsteam",
          "versions": [
            {
              "lessThanOrEqual": "4.23.2",
              "status": "affected",
              "version": "4.17.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged."
    }
  ],
  "id": "CVE-2026-123017",
  "lastModified": "2026-11-05T07:17:24.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-11-05T07:17:24.450",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://codeberg.org/godotsteam/godotsteam"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.openwall.com/lists/oss-security/2026/11/04/11"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Primary"
    }
  ]
}
View JSON API Download JSON