CVE-2026-103397
Received Received - Intake

OpenSave WAN Relay Identity Spoofing Vulnerability

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulnCheck

Description
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103397
EUVD
EUVD-2026-89992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
liquid-co opensave to 2.4.0-beta.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests. This allows unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join the network, extract paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized WAN relay requests with spoofed sender identities. Check OpenSave logs for unexpected file operations or sync requests from unpaired devices. Use packet inspection tools like Wireshark to analyze RelayMessage From fields for inconsistencies. Ensure all paired devices are correctly listed and no unknown devices are active.

Impact Analysis

An attacker could access your saved game data, modify or delete files, or perform unauthorized file operations on your machine. They could also impersonate paired devices to manipulate sync processes, potentially leading to data loss or corruption. The vulnerability enables reading and writing files in arbitrary directories due to path traversal.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It undermines data integrity and access controls, potentially resulting in non-compliance with privacy and security standards that mandate protection against unauthorized data exposure.

Mitigation Strategies

Update OpenSave to version 2.4.0-beta.1 or later to address the authentication bypass and implement end-to-end encryption for WAN sync.

  • Disable WAN relay usage if possible and rely on LAN sync, which does not require encryption.
  • Monitor for unauthorized file access or sync operations in system logs, especially in directories where save files are stored.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103397. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart