PT-2026-137400

CVE-2026-123017

Published

2026-11-05

Updated

2026-11-05

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant gold(1000000) call can be forged.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾