GodotSteam 4.17 through 4.23.2 lets any player claim server peer ID
Original title: GodotSteam 4.17 through 4.23.2: any multiplayer peer can claim the server's peer ID
GodotSteam v4.17 to 4.23.2 accepts any peer ID without verification allowing players to claim server status.
GodotSteam does not compare the peer ID in the first packet to Steam-verified account connections. Players writing ID 1 are treated as the server and can issue commands. The issue affects multiplayer sessions and was reported on November 4 2026.
- Steam verifies accounts behind connections but GodotSteam does not compare peer IDs
- Player can issue server commands by claiming peer ID 1
- Affects versions 4.17 through 4.23.2
Impact: Arbitrary server control in multiplayer sessions
From the original article
Posted by Tomasz Kaye on Nov 04 GodotSteam lets any player in a session claim to be the server. Godot names players by a peer ID, and ID 1 means the server. Steam verifies the account behind each connection, but GodotSteam accepts whatever peer ID the sender writes into its first packet and never compares the two.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.