CVE-2026-123017: Medium severity vulnerability
Published Nov 5, 2026
·Updated
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grantgold(1000000) call can be forged.
Event History
Nov 5, 2026
CVE Published
via MITRE·06:17 AM
Data Sourced
via MITRE·06:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Networked games using GodotSteam versions 4.17 through 4.23.2 are affected if they rely on peer value 1 to identify the server for privileged game actions.
2
What does an attacker need to exploit this?
An attacker needs network access to the affected game session. No privileges or user interaction are required, and the attacker can forge a grant_gold(1000000) call by claiming peer value 1.
3
What is the practical impact?
A networked co-player can act as the server for trusted actions. The documented example allows forging a call that grants 1,000,000 gold.