CVE-2026-28428

{"id": "CVE-2026-28428", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-06T05:16:31.607", "references": [{"url": "https://github.com/Talishar/Talishar/commit/a9c218efa37756c9e7eed056fbff6ee03f79aefc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Talishar/Talishar/security/advisories/GHSA-2659-p579-wv83", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Talishar is a fan-made Flesh and Blood project. Prior to commit a9c218e, an authentication bypass vulnerability in Talishar's game endpoint validation logic allows any unauthenticated attacker to perform authenticated game actions \u2014 including sending chat messages and submitting game inputs \u2014 by supplying an empty authKey parameter (authKey=). The server-side validation uses a loose comparison that accepts an empty string as a valid credential, while correctly rejecting non-empty but incorrect keys. This asymmetry means the authentication mechanism can be completely bypassed without knowing any valid token. This issue has been patched in commit a9c218e."}, {"lang": "es", "value": "Talishar es un proyecto de Flesh and Blood creado por fans. Antes del commit a9c218e, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la l\u00f3gica de validaci\u00f3n del endpoint de juego de Talishar permite a cualquier atacante no autenticado realizar acciones de juego autenticadas \u2014 incluyendo el env\u00edo de mensajes de chat y la introducci\u00f3n de entradas de juego \u2014 al proporcionar un par\u00e1metro authKey vac\u00edo (authKey=). La validaci\u00f3n del lado del servidor utiliza una comparaci\u00f3n laxa que acepta una cadena vac\u00eda como credencial v\u00e1lida, mientras que rechaza correctamente las claves no vac\u00edas pero incorrectas. Esta asimetr\u00eda significa que el mecanismo de autenticaci\u00f3n puede ser completamente omitido sin conocer ning\u00fan token v\u00e1lido. Este problema ha sido parcheado en el commit a9c218e."}], "lastModified": "2026-04-20T12:57:06.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:talishar:talishar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB6EC428-F449-46D5-B308-45979347E391", "versionEndExcluding": "2026-02-22"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}