CVE-2026-112303
Received Received - Intake

GDevelop Desktop App Credential Leak via Resource URLs

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112303
EUVD
EUVD-2026-104395

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GDevelop GDevelop 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GDevelop desktop app through 5.6.284 has a credential leak vulnerability where attackers can steal the gd_resource cookie by tricking victims into opening a crafted project file containing attacker-controlled resource URLs. When the victim opens the project, the app's downloadLocalFile() function sends the cookie to the attacker's server, exposing private cloud project resources.

Detection Guidance

Check GDevelop project files for URLs pointing to external domains. Monitor network traffic for outbound requests containing the 'gd_resource' cookie to untrusted hosts. Inspect Electron app sessions for unauthorized cookie access.

Impact Analysis

If you use GDevelop 5.6.284 or earlier, an attacker could steal your gd_resource cookie by getting you to open a malicious project file. This could expose your private cloud project resources, allowing the attacker to access or download your sensitive files without authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to private data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Organizations using GDevelop may face compliance breaches if user data is exposed.

Mitigation Strategies
  • Update GDevelop to the latest version where the fix is applied.
  • Avoid opening untrusted project files in GDevelop.
  • Review and revoke any exposed 'gd_resource' cookies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart