---
id: CVE-2026-123017
title: >-
  GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a
  player is the server
summary: >-
  GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a
  player is the server. A grant_gold(1000000) call can be forged.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-290
vendor: godotsteam
product: GodotSteam
affected:
  - GodotSteam >= 4.17.0 <= 4.23.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:05:46.734Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123017'
references:
  - url: >-
      https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game
  - url: >-
      https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim
  - url: 'https://codeberg.org/godotsteam/godotsteam'
  - url: 'https://www.openwall.com/lists/oss-security/2026/11/04/11'
tags:
  - cve.org
epss: 0.00258
epssPercentile: 0.17526
ingestedAt: '2026-11-05T21:36:00.793Z'
---

## Overview

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

## Affected

- `GodotSteam >= 4.17.0 <= 4.23.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Game-side only: on the plugin's peer_connected signal for peer ID 1, compare Steam.get_steam_id_for_peer_id(1) with the expected server Steam ID (the lobby owner, or the ID passed to create_client) and close the multiplayer peer on a mismatch. The guard ships in the reproduction kit. No plugin setting rejects a false claim.