CVE-2026-103397CWE-290

CVE-2026-103397

Medium · published September 30, 2026

CVSS v3.1
5.6
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00219 · 11.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-30T19:22Z
References (5)
https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb · [email protected]https://github.com/Liquid-co/OpenSave · [email protected]https://github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282 · [email protected]https://github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3 · [email protected]https://www.vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-sender · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 14:48Z
    OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
    cvelistv5