PT-2026-23648 · Talishar · Talishar

Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-28428

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Talishar versions prior to commit a9c218e

Description Talishar is a fan-made Flesh and Blood project with an authentication bypass issue in its game endpoint validation logic. An unauthenticated attacker can perform authenticated game actions, including sending chat messages and submitting game inputs, by providing an empty authKey parameter. The server-side validation uses a loose comparison, incorrectly accepting an empty string as a valid credential. This bypass occurs because the authentication mechanism can be circumvented without a valid token. The vulnerable endpoint is the game endpoint.

Recommendations Update Talishar to commit a9c218e or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-28428

GHSA-2659-P579-WV83

Affected Products

Talishar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28428.json · Exploit
• https://github.com/Talishar/Talishar/commit/a9c218efa37756c9e7eed056fbff6ee03f79aefc · Patch
• https://github.com/Talishar/Talishar/security/advisories/GHSA-2659-p579-wv83 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28428 · Security Note
• https://twitter.com/CVEnew/status/2029975567580488086 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029976906884382981 · Twitter Post
• https://t.me/CVEtracker/46540 · Telegram Post