CVE-2026-123017 in GodotSteam
Summary
by MITRE • 11/05/2026
GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability in GodotSteam versions 4.17 through 4.23.2 stems from an insecure trust model regarding peer identification within multiplayer game sessions that utilize Steam networking features. In this architecture, the application logic assumes that a connection originating with a specific peer identifier value of one inherently represents the authoritative server instance rather than a client player. This assumption creates a critical authentication bypass mechanism because it fails to validate whether the entity claiming to be the server actually possesses the necessary privileges or originates from an expected network source. By exploiting this flawed trust relationship, an attacker can manipulate session parameters to impersonate the game host without requiring valid administrative credentials or proper handshake verification protocols.
This architectural flaw directly enables remote code execution scenarios within the context of the game's economy and logic systems. Specifically, attackers can forge requests for in-game currency grants by invoking functions such as grant_gold with excessively large values like one million units. Since the system accepts these forged calls from any peer identified as having a value of one, malicious actors can inject arbitrary amounts of virtual assets into their accounts or those of other players. This manipulation disrupts game balance and economy integrity while potentially allowing for further exploitation if such functions interact with broader application states beyond simple currency updates.
From an industry standards perspective, this vulnerability aligns closely with CWE-287 Improper Authentication where the system fails to correctly verify identity before granting access or performing sensitive operations. Additionally it relates to CWE-345 Insufficient Verification of Data Authenticity as the peer identifier is accepted without sufficient proof of its legitimacy relative to expected server roles. In terms of MITRE ATT&CK framework this behavior corresponds to T1078 Valid Accounts where attackers leverage legitimate-looking identifiers to gain unauthorized access and potentially T1190 Exploit Public-Facing Application if the game servers are exposed directly to untrusted networks without adequate input validation layers.
The operational impact extends beyond immediate economic disruption as it undermines player trust in fair play mechanics and may lead to widespread exploitation across affected titles relying on these library versions. Game developers must recognize that implicit assumptions about network roles based solely on numeric identifiers are insufficient for secure multiplayer environments especially when those identifiers can be manipulated by external parties. The ability to forge high-value transactions indicates a lack of cryptographic signing or token-based verification for critical server-side commands which should have been implemented regardless of peer numbering schemes.
Mitigation strategies require immediate updates to the GodotSteam library version beyond 4.23.2 where this issue has likely been addressed through stricter validation mechanisms. Developers integrating older versions must implement additional checks such as verifying Steam ID ownership against expected host configurations and ensuring that sensitive functions like grant_gold are protected by server-side authorization tokens rather than relying on client-provided peer numbers. Network-level filtering should also be employed to restrict direct access to game logic endpoints from unverified sources while enforcing strict input validation rules for all parameters passed during session initialization phases.