Cyber ·
GodotSteam 4.17 to 4.23.2: any participant can take over the server peer ID
An advisory published on November 4, 2026 on the oss-sec feed describes a GodotSteam flaw: the peer ID sent by the player is not compared with the Steam-verified account, letting a participant impersonate the server.
The advisory states that GodotSteam, in versions 4.17 through 4.23.2 according to the text, accepts the peer ID the sender writes in the first packet and never compares it with the account verified by Steam. In Godot, players are identified by a peer ID, and ID 1 represents the server. So a player who writes 1 is treated as the server and can issue the commands a server issues. Steam verifies the account behind each connection, but that check is not used to validate the peer ID in GodotSteam. The available text is a machine translation of an advisory published on the oss-sec feed on November 4, 2026. The excerpt read does not give a fix version or vulnerability identifier, so the fixed version cannot be confirmed from it. To verify, consult the original advisory through the reference given in the source text and the GodotSteam project release notes. Relevance for teams using multiplayer games or sessions is direct: any project depending on these versions should check the installed version and apply the fix the maintainers publish. Rota Nacional does not host game sessions or patch third-party libraries, and this advisory does not change how the API works.