PT-2026-29007 · Arthurfiorette+1 · Steam-Trader+1

Jamshed Yergashvoyev + 1 · Publicado 2026-03-30 · Atualizado 2026-03-31 · CVE-2026-5128

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ArthurFiorette steam-trader version 2.1.1

Description A sensitive information exposure issue exists. An unauthenticated attacker can send a request to the /users API endpoint to retrieve sensitive Steam account data, including the account username, password, identity secret, and shared secret. Application logs also expose authentication artifacts such as access tokens, refresh tokens, and session identifiers. This information allows an attacker to generate valid Steam Guard (2FA) codes, hijack authenticated sessions, and obtain full control over the affected Steam account, including unauthorized access to inventory and trading functionality. The vulnerable parameter is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Information Disclosure

Enumeração de Fraquezas

CWE-532

CWE-200

Identificadores relacionados

CVE-2026-5128

Produtos afetados

Steam

Steam-Trader

Referências · 7

• https://github.com/arthurfiorette/steam-trader · Nota
• https://twitter.com/CosmicBytez/status/2038817679101120694 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038618086287323161 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-5128 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2038560010452562289 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038568612563415476 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2038555419526697069 · Publicação no Twitter