CVE-2026-112303 in GDevelop
Summary
by MITRE • 10/19/2026
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The GDevelop desktop application, specifically versions up through 5.6.284, contains a critical credential leak vulnerability that stems from improper handling of resource URLs within project files. This flaw allows an attacker who can supply crafted project files to victims to exfiltrate sensitive authentication data. The core technical issue lies in the execution flow triggered when a victim opens a maliciously constructed GDevelop project file. Upon opening, the application processes various resources defined within that file structure. Among these processed items are URLs intended for local resource downloads or references. However, due to insufficient validation and sanitization of these URL inputs, the application fails to distinguish between legitimate internal requests and those designed to exploit cross-site request mechanisms against its own authentication context.
The specific mechanism of exploitation involves the downloadLocalFile function within the GDevelop codebase. When a crafted project file is opened, it contains resource URLs controlled by an attacker. As the application attempts to resolve or prepare these resources for use in the game environment, it invokes the downloadLocalFile routine. This routine, while designed to fetch local assets, inadvertently includes authentication cookies associated with the user's current session when making requests that involve external domains or specific URL patterns manipulated by the attacker. Consequently, instead of simply loading a static asset, the application sends an HTTP request containing the gd_resource cookie to a server controlled by the malicious actor who authored the project file. This behavior effectively turns the victim’s machine into a proxy for credential theft, bypassing standard browser-based same-origin policies because this is a desktop native application rather than a web sandboxed environment.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of user accounts associated with GDevelop's cloud services. The gd_resource cookie serves as an authentication token that grants access to private cloud project resources. By stealing this cookie, attackers can impersonate the victim within the GDevelop ecosystem. This unauthorized access allows for the reading, modification, or deletion of sensitive game projects stored in the cloud. Beyond immediate data theft, this compromise undermines user trust and exposes intellectual property such as source code, assets, and design documents to potential misuse. The vulnerability is particularly dangerous because it requires no additional interaction from the victim beyond opening a file, which is a common workflow for developers sharing prototypes or templates with colleagues or online communities.
From a classification perspective, this flaw aligns closely with CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, and more specifically CWE-524 regarding the use of cacheable credentials in URLs if applicable, though here it is primarily about session token leakage via HTTP requests. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through Trusted Software Distribution or Supply Chain Compromise if malicious files are distributed widely, and Credential Access techniques such as Steal Web Session Cookie (T1539). The attack vector relies on social engineering elements where a user is tricked into opening a file that appears legitimate but contains embedded malicious logic targeting the application's resource handling subsystem.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For users, it is imperative to upgrade immediately to GDevelop version 5.6.285 or later where this issue has been patched by enforcing stricter validation on URL schemes and ensuring that authentication cookies are not sent for cross-origin resource requests unless explicitly permitted by security policies like SameSite attributes. Developers should implement strict allow-lists for domains allowed in project files and ensure that the downloadLocalFile function does not attach session credentials to external network calls. Furthermore, implementing Content Security Policy-like restrictions within the desktop application's web view or renderer can prevent unauthorized data exfiltration. Regular audits of how third-party assets are handled during file loading processes will help identify similar patterns where local resources might inadvertently trigger network requests with sensitive headers attached.