CVE-2026-103397
OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
Liquid-co OpenSave
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.4.0-beta.1OpenSaveCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.
Text from CVE List
Affected versions 1
- OpenSaveaffected: all versions before 2.4.0-beta.1CVE List
References 5
- github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3Fixvia CVE List
- gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdbAdvisoryvia CVE List
- vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-senderAdvisoryvia CVE List
- github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282Referencevia CVE List
- github.com/Liquid-co/OpenSaveReferencevia CVE List