CVE-2026-103397

Name of the Vulnerable Software and Affected Versions OpenSave versions prior to 2.4.0-beta.1

Description OpenSave fails to validate sender identity in WAN relay requests. This allows unpaired room members to impersonate paired devices by spoofing the From field within the RelayMessage. Attackers with knowledge of the room code can join the session, identify paired peer identifiers through announcements, and send forged requests to access protected sync routes, which include save data, snapshots, and file operations.

Recommendations Update to version 2.4.0-beta.1 or later.