CVE-2026-123017

Published: Nov 5, 2026Modified: Nov 5, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: MITRE (Secondary)

Description

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

Related CWEs

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (5)

https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game

Source: cve@mitre.org

https://codeberg.org/godotsteam/godotsteam

Source: cve@mitre.org

https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2026/11/04/11

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2026/11/05/5

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.