PT-2026-29007 · Arthurfiorette+1 · Steam-Trader+1

Jamshed Yergashvoyev + 1 · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-5128

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ArthurFiorette steam-trader version 2.1.1

Description A sensitive information exposure issue exists. An unauthenticated attacker can send a request to the /users API endpoint to retrieve sensitive Steam account data, including the account username, password, identity secret, and shared secret. Application logs also expose authentication artifacts such as access tokens, refresh tokens, and session identifiers. This information allows an attacker to generate valid Steam Guard (2FA) codes, hijack authenticated sessions, and obtain full control over the affected Steam account, including unauthorized access to inventory and trading functionality. The vulnerable parameter is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

CVE-2026-5128

Affected Products

Steam

Steam-Trader

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5128 · Security Note
• https://github.com/arthurfiorette/steam-trader · Note
• https://twitter.com/CosmicBytez/status/2038817679101120694 · Twitter Post
• https://twitter.com/CVEnew/status/2038618086287323161 · Twitter Post
• https://twitter.com/CveFindCom/status/2038560010452562289 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038568612563415476 · Twitter Post
• https://twitter.com/0dayPublishing/status/2038555419526697069 · Twitter Post