CVE-2026-123017 · Package
NO FIX YET · SEE WHAT TO DO
GodotSteam, a Steam integration plugin for the Godot game engine, treats a peer ID of 1 as the game server. A connected player can therefore send a forged grant_gold(1000000) call and be credited with that amount.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Multiplayer games built on GodotSteam 4.17 through 4.23.2 that use peer ID 1 to decide server-only actions such as granting currency. Single-player games and projects that do not use these RPCs are not affected by this flaw.
Not affected if no-server-rpcs, single-player, versions-outside-range
Who cares godot, godotsteam, multiplayer-games, steam
addons folder and read its version.grant_gold or other server-only RPCs that do not verify the sender.4.23.2 and earlier in the affected range (4.17 through 4.23.2) are vulnerable; the sources do not name a fixed version.GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.