Vulnerability DatabaseCVE-2026-103397
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-103397
Published:September 30, 2026
Updated:October 15, 2026
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
Affected Packages
https://github.com/Liquid-co/OpenSave.git (GITHUB):
Affected version(s) >=v2.3.0 <v2.4.0
Fix Suggestion:
Update to version v2.4.0
Related Resources (7)
https://www.vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-sender
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103397.json
https://github.com/Liquid-co/OpenSave
https://github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3
https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb
https://github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282
https://nvd.nist.gov/vuln/detail/CVE-2026-103397
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.6
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Authentication Bypass by Spoofing
CWE-290
EPSS
Base Score:
0.22