{"id":"CVE-2026-123017","title":"GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server","summary":"GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-290"],"vendor":"godotsteam","product":"GodotSteam","affected":["GodotSteam >= 4.17.0 <= 4.23.2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:05:46.734Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123017","references":[{"url":"https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game"},{"url":"https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim"},{"url":"https://codeberg.org/godotsteam/godotsteam"},{"url":"https://www.openwall.com/lists/oss-security/2026/11/04/11"}],"tags":["cve.org"],"epss":0.00258,"epssPercentile":0.17526,"ingestedAt":"2026-11-05T21:36:00.793Z","slug":"CVE-2026-123017","body":"## Overview\n\nGodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.\n\n## Affected\n\n- `GodotSteam >= 4.17.0 <= 4.23.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nGame-side only: on the plugin's peer_connected signal for peer ID 1, compare Steam.get_steam_id_for_peer_id(1) with the expected server Steam ID (the lobby owner, or the ID passed to create_client) and close the multiplayer peer on a mismatch. The guard ships in the reproduction kit. No plugin setting rejects a false claim.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}