CVE-2026-103397
⚪ Do wiadomości
Brak weryfikacji tożsamości nadawcy w OpenSave umożliwia podszywanie się pod urządzenia.
CVSS
5.6
EPSS
0.2%
Exploit
none
Vendor
Opis źródłowy (NVD)
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.6 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.2% |
| Opublikowano (NVD) | 2026-09-30 15:22:28 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-02 17:17:02 UTC |
Referencje
- https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb ([email protected])
- https://github.com/Liquid-co/OpenSave ([email protected])
- https://github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282 ([email protected])
- https://github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3 ([email protected])
- https://www.vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-sender ([email protected])