Cpe:2.3:a:godotsteam:godotsteam:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agodotsteamgodotsteam/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 21:08:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGodotSteam: Server peer ID spoofinghttps://feed.craftedsignal.io/briefs/2026-11-godotsteam-peer-id-spoofing/Wed, 04 Nov 2026 21:08:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-godotsteam-peer-id-spoofing/A vulnerability in GodotSteam versions 4.17 through 4.23.2 allows any multiplayer peer to claim the server ID of 1, enabling unauthorized administrative command execution.GodotSteam versions 4.17 through 4.23.2 contain a vulnerability where the library fails to validate the peer ID transmitted in initial network packets against the Steam-verified account identity. In Godot, the server is identified by peer ID 1. Because the library accepts the peer ID provided by the sender without cross-referencing it with the Steam authentication layer, any connected client can spoof their ID as 1 and gain the privileges reserved for the game server.

Impact

Successful exploitation allows a malicious client to impersonate the game server and issue administrative commands within the session.

Recommendation

  • Update GodotSteam to a patched version beyond 4.23.2 as soon as one is made available by the maintainers.
  • Implement server-side validation for all critical administrative actions to ensure that commands are only accepted when they originate from the host's actual SteamID, rather than relying solely on internal peer IDs.
  • Perform code audits on game logic that relies on the peer ID value provided by the GodotSteam library for authorization.
]]>highadvisory