CVE-2026-103397
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
Risk Assessment
An attacker could gain unauthorized access to sync data, potentially leading to confidentiality and integrity breaches of user data.
Recommendation
Update OpenSave to version 2.4.0-beta.1 or later, which includes the fix.
Other vulnerabilities in OpenSave
Original NVD description (English source)
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS