GodotSteam Peer Trust Server Privilege Escalation

Executive Summary

CVE-2026-123017 is a vulnerability in the GodotSteam plugin for the Godot game engine. It allows any networked player in a multiplayer game to impersonate the server by claiming the server's peer ID (1) during the initial connection handshake. The plugin does not validate this peer ID, enabling attackers to send forged commands that the victim's game treats as legitimate server actions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for spoofed peer ID claims during the GodotSteam handshake. Inspect packets where a client claims peer ID 1, as this should only be assigned to the server. Use tools like Wireshark to filter Steam traffic and check for invalid peer ID assignments in multiplayer sessions.

Useful 0 Not Useful 0

Impact Analysis

If you play multiplayer games using GodotSteam versions 4.17 through 4.23.2, an attacker could impersonate the server and manipulate your game state. This includes executing unauthorized commands like granting excessive in-game currency or altering game progress. The attack requires specific setup but can lead to unfair advantages or disrupted gameplay.

Useful 0 Not Useful 0

Mitigation Strategies

• Update GodotSteam to the latest patched version if available. If no patch exists, implement server-side checks to reject peer ID claims of 1 from clients.
• Validate client peer IDs against Steam account IDs during the handshake to ensure only legitimate peers claim specific IDs.
• Terminate sessions where a client claims peer ID 1, as this indicates a potential impersonation attempt.
• Monitor game logs for unauthorized RPC calls or commands that appear to originate from the server but are actually forged.

Useful 0 Not Useful 0