What’s Vulnerable › Vulnerabilities

CVE-2026-103397: OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender

• Severity: medium (CVSS 5.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-02
• Weakness: CWE-290

Description

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

Affected products

• Liquid-co OpenSave: before 2.4.0-beta.1 — fixed in 2.4.0-beta.1

How to fix

Upgrade to a fixed version: Liquid-co OpenSave 2.4.0-beta.1. Check the vendor advisory for mitigations.

References

• https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb
• https://github.com/Liquid-co/OpenSave
• https://github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282
• https://github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3
• https://www.vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-sender

Get alerted when CVE-2026-103397 or the next vulnerability affects your stack