Live › vulnerability › CVE-2026-112303
Go to dashboardGDevelop's desktop app, through version 5.6.284, sends its gd_resource cookie to any server named in a project file's resource URLs. An attacker who gets a victim to open a crafted project can read the cookie and reach the victim's private cloud project resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who runs the GDevelop desktop app through 5.6.284 and opens project files, especially ones shared from outside the team. The exposure depends on the victim being signed in to GDevelop cloud services, since the leaked cookie is the gd_resource cookie. Teams that only use the web editor or never open external projects are less exposed.
No product ranges from the sources yet.
5.6.284, using the app's About dialog or the installed package metadata.5.6.284; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-112303")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.