CVE-2026-123017Medium· 6.5▾ SunlitGodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
GodotSteam >= 4.17.0 <= 4.23.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Game-side only: on the plugin's peer_connected signal for peer ID 1, compare Steam.get_steam_id_for_peer_id(1) with the expected server Steam ID (the lobby owner, or the ID passed to create_client) and close the multiplayer peer on a mismatch. The guard ships in the reproduction kit. No plugin setting rejects a false claim.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116790Critical· 9.1FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY
CVE-2026-102895Critical· 9.8GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
CVE-2026-118513High· 7.7Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
CVE-2026-119744High· 8.8Cendio ThinLinc Improper Authentication via Web Access
CVE-2026-123033High· 8.3Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-ad…
CVE-2026-107774Medium· 5.3Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form