GodotSteam vulnerabilities

CVEs whose affected-version data names the GodotSteam package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-123017Medium· 6.5

yesterday

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

▾ Sunlitgodotsteam · GodotSteamEPSS 0.26%via CVEORG