{"affected":[{"defaultStatus":"unknown","product":"GodotSteam","source":"CNA: mitre","vendor":"godotsteam","versions":[{"lessThanOrEqual":"4.23.2","status":"affected","version":"4.17.0","versionType":"semver"}]}],"cveId":"CVE-2026-123017","cwes":["CWE-290"],"description":"GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793859424908,"publishedAt":1793859424908,"references":[{"source":"CNA: mitre","tags":[],"url":"https://axeghost.offprint.app/a/3mzhxoqpnh423-any-networked-co-player-can-act-as-the-server-in-a-godotsteam-game"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/bitbutter/godot-security-pocs/tree/main/2026-11-godotsteam-peer-id-claim"},{"source":"CNA: mitre","tags":[],"url":"https://codeberg.org/godotsteam/godotsteam"},{"source":"CNA: mitre","tags":[],"url":"https://www.openwall.com/lists/oss-security/2026/11/04/11"}],"remediation":[{"kind":"workaround","source":"CNA: mitre","text":"Game-side only: on the plugin's peer_connected signal for peer ID 1, compare Steam.get_steam_id_for_peer_id(1) with the expected server Steam ID (the lobby owner, or the ID passed to create_client) and close the multiplayer peer on a mismatch. The guard ships in the reproduction kit. No plugin setting rejects a false claim."}],"revision":"20ca0f789711ad7e190244ddd23702efd142e8bac4188f892a9c3e5772983bbd","sources":[{"modifiedAt":1793859424908,"name":"CNA: mitre","retrievedAt":1793862512902,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123017"}],"ssvc":null,"status":"published","title":"CVE-2026-123017","updatedAt":1793862512902}