OpenSave CVE-2026-103397

Exploitation requires the attacker to already possess a valid OpenSave room code and to join that room as an unpaired member over the WAN relay; the vulnerable path is the WAN relay RelayMessage handling (internal/p2p/wanclient_handlers.go) which does not validate sender identity, letting the attacker spoof the From field to impersonate an already-paired device and reach protected sync routes. Limiting factors: the room code is a 12-character cryptographically generated value that is not guessable and must be shared out-of-band, so realistic attackers are limited to people who were deliberately given (or who leak) a room code - not the open internet. Both endpoints must be on a version before 2.4.0-beta.1; the fix adds end-to-end encryption plus single-use per-request proof that the sender holds the key pinned at pairing, and requires re-pairing over the relay to take effect.

This is a genuine but bounded authentication-bypass (CWE-290, spoofing) flaw in OpenSave's WAN relay. The vendor/VulnCheck CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VC:L/VI:L/VA:L yields 6.3 (medium), and the metrics are internally consistent with the description: exploitation is remote and technically simple, but the AT:P (Attack Requirement present) correctly captures that the attacker must first be inside the room. The PR:N is defensible because the app performs no per-request authentication of the sender - that is precisely the defect - but the practical gate is possession of the room code, which the description states is 12 characters from a cryptographic generator and therefore not guessable. No EPSS score, KEV listing, or SSVC decision data was provided; there is no CISA KEV entry, so this is not confirmed active exploitation. A public gist by the reporter is referenced and may contain proof-of-concept material, but the input does not flag it as a working exploit, so exploitation status should be treated as unconfirmed. Net: a real, credible weakness worth patching for OpenSave users, but the low real-world deployment footprint and the room-code precondition make this a low-to-medium operational priority rather than an urgent widespread threat. The triple-Low impact (VC/VI/VA:L) means no single high-consequence outcome.

A user shares an OpenSave room code with someone (or it leaks). That person joins the WAN relay room as an unpaired member, watches the room announcements to learn a legitimately paired device's identifier, then sends a RelayMessage with the From field spoofed to that identifier - impersonating the paired peer and gaining access to protected sync routes such as save data, snapshots, and file operations. A gist referenced in the advisory may provide proof-of-concept steps, but active exploitation is not confirmed.