GodotSteam 4.17 through 4.23.2: any multiplayer peer can claim the server's peer ID

Summary by Cyber Security News4 Nov 2026, 19:42 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/518

Posted by Tomasz Kaye on Nov 04 GodotSteam lets any player in a session claim to be the server. Godot names players by a peer ID, and ID 1 means the server. Steam verifies the account behind each connection, but GodotSteam accepts whatever peer ID the sender writes into its first packet and never compares the two.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Hugging Face’s CEO Says His P(Doom) Is ‘Close to Zero’

Building on open source AI? Hugging Face’s policy chief on the costs, risks, and trade-offs

The GNU C Library security advisories update for 2026-11-04

Apache OFBiz: CVE Announcements

libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)

[SECURITY] Apache Juneau 9.2.1 fixes multiple vulnerabilities (CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100, CVE-2026-73101, CVE-2026-73098, CVE-2026-73116, CVE-2026-73117)