Cyber ·
CVE-2026-123017: GodotSteam 4.17 to 4.23.2 lets a multiplayer peer claim the server peer ID
Public notice on CVE-2026-123017 in GodotSteam, versions 4.17 to 4.23.2: any multiplayer peer can claim the server peer ID. Published score 6.5; the report asks to raise integrity impact to 8.2.
According to the text received from the oss-sec feed, CVE-2026-123017 was assigned and published on 5 November 2026. The issue affects GodotSteam versions 4.17 through 4.23.2 and describes that any multiplayer peer can claim the server peer ID.
The published record assigns a score of 6.5, with low integrity impact. The report's author asked the MITRE CNA-LR team to raise the integrity impact to high, which would result in 8.2, because the default host rejected a forged command carrying the attacker's own peer ID but executed it when the handshake indicated the value 1. The text presents itself as a correction to the original publication. The source mentions two source-code paths, but the received excerpt is truncated and does not list a fixed version.
Relevance: this is a flaw in third-party software for multiplayer games. Rota Nacional does not patch external libraries, and this case is not a platform feature. Anyone using GodotSteam should check the version in use, consult the official CVE record and the project notice, and apply the update the vendor indicates.