Mansurmavlankulov

**Name of the Vulnerable Software and Affected Versions** OpenSave versions prior to 2.4.0-beta.1 **Description** OpenSave fails to validate sender identity in WAN relay requests. This allows unpaired room members to impersonate paired devices by spoofing the `From` field within the `RelayMessage`. Attackers with knowledge of the room code can join the session, identify paired peer identifiers through announcements, and send forged requests to access protected sync routes, which include save data, snapshots, and file operations. **Recommendations** Update to version 2.4.0-beta.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSave versions prior to 2.4.1 **Description** The manifest request handler fails to properly validate save paths provided by paired peers. This allows attackers to specify arbitrary directories outside of the configured save locations to read and write files via the manifest and sync routes. **Recommendations** Update to a version newer than 2.4.0.